Skip to content

Commit eb1f1c3

Browse files
data-douserCopilot
data-douser
and
Copilot
authored
Pin actions to full-length commit SHAs (#190)
* Pin actions to full-length commit SHAs This commit: - pins each GitHub Action, regardless of publisher/maintainter, to its full-length commit SHA (instead of tag) to ensure that all actions refs are immutable; - updates the .github/instructions/*.md for actions and workflows; * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Nathan Randall <70299490+data-douser@users.noreply.github.com> * Update github_workflows_yaml.instructions.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Nathan Randall <70299490+data-douser@users.noreply.github.com> --------- Signed-off-by: Nathan Randall <70299490+data-douser@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
1 parent 93d646d commit eb1f1c3

17 files changed

+59
-58
lines changed

‎.github/actions/setup-codeql-environment/action.yml‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ runs:
8282
- name: Cache `gh-codeql` extension and CodeQL packages (Unix)
8383
id: cache-codeql-unix
8484
if: runner.os != 'Windows'
85-
uses: actions/cache@v5
85+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
8686
with:
8787
path: |
8888
~/.local/share/gh-codeql
@@ -94,7 +94,7 @@ runs:
9494
- name: Cache `gh-codeql` extension and CodeQL packages (Windows)
9595
id: cache-codeql-windows
9696
if: runner.os == 'Windows'
97-
uses: actions/cache@v5
97+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
9898
with:
9999
path: |
100100
~\AppData\Local\GitHub\gh-codeql
@@ -320,7 +320,7 @@ runs:
320320
321321
- name: Setup Node.js
322322
if: inputs.install-language-runtimes == 'true'
323-
uses: actions/setup-node@v6
323+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
324324
with:
325325
cache: 'npm'
326326
cache-dependency-path: 'package-lock.json'
@@ -330,7 +330,7 @@ runs:
330330
- name: Cache language runtimes
331331
id: cache-runtimes
332332
if: inputs.install-language-runtimes == 'true'
333-
uses: actions/cache@v5
333+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
334334
with:
335335
path: |
336336
~/go/pkg/mod
@@ -344,42 +344,42 @@ runs:
344344
345345
- name: Setup Python (with cache)
346346
if: inputs.install-language-runtimes == 'true' && contains(inputs.languages, 'python') && steps.check-deps.outputs.python-deps == 'true'
347-
uses: actions/setup-python@v6
347+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
348348
with:
349349
python-version: ${{ inputs.python-version }}
350350
cache: 'pip'
351351

352352
- name: Setup Python (without cache)
353353
if: inputs.install-language-runtimes == 'true' && contains(inputs.languages, 'python') && steps.check-deps.outputs.python-deps == 'false'
354-
uses: actions/setup-python@v6
354+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
355355
with:
356356
python-version: ${{ inputs.python-version }}
357357

358358
- name: Setup Java (with cache)
359359
if: inputs.install-language-runtimes == 'true' && contains(inputs.languages, 'java') && steps.check-deps.outputs.java-deps == 'true'
360-
uses: actions/setup-java@v5
360+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
361361
with:
362362
distribution: 'temurin'
363363
java-version: ${{ inputs.java-version }}
364364
cache: 'maven'
365365

366366
- name: Setup Java (without cache)
367367
if: inputs.install-language-runtimes == 'true' && contains(inputs.languages, 'java') && steps.check-deps.outputs.java-deps == 'false'
368-
uses: actions/setup-java@v5
368+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
369369
with:
370370
distribution: 'temurin'
371371
java-version: ${{ inputs.java-version }}
372372

373373
- name: Setup Go (with cache)
374374
if: inputs.install-language-runtimes == 'true' && contains(inputs.languages, 'go') && steps.check-deps.outputs.go-deps == 'true'
375-
uses: actions/setup-go@v6
375+
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
376376
with:
377377
go-version: ${{ inputs.go-version }}
378378
cache: true
379379

380380
- name: Setup Go (without cache)
381381
if: inputs.install-language-runtimes == 'true' && contains(inputs.languages, 'go') && steps.check-deps.outputs.go-deps == 'false'
382-
uses: actions/setup-go@v6
382+
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
383383
with:
384384
go-version: ${{ inputs.go-version }}
385385
cache: false
@@ -388,7 +388,7 @@ runs:
388388
- name: Cache .NET packages
389389
if: inputs.install-language-runtimes == 'true' && contains(inputs.languages, 'csharp')
390390
id: cache-dotnet-packages
391-
uses: actions/cache@v5
391+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
392392
with:
393393
path: |
394394
~/.nuget/packages
@@ -400,20 +400,20 @@ runs:
400400
401401
- name: Setup .NET (for C#)
402402
if: inputs.install-language-runtimes == 'true' && contains(inputs.languages, 'csharp')
403-
uses: actions/setup-dotnet@v5
403+
uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5
404404
with:
405405
dotnet-version: ${{ inputs.dotnet-version }}
406406

407407
- name: Setup Ruby (with cache)
408408
if: inputs.install-language-runtimes == 'true' && contains(inputs.languages, 'ruby') && steps.check-deps.outputs.ruby-deps == 'true'
409-
uses: ruby/setup-ruby@v1
409+
uses: ruby/setup-ruby@4dc28cf14d77b0afa6832d9765ac422dbf0dfedd # v1
410410
with:
411411
ruby-version: ${{ inputs.ruby-version }}
412412
bundler-cache: true
413413

414414
- name: Setup Ruby (without cache)
415415
if: inputs.install-language-runtimes == 'true' && contains(inputs.languages, 'ruby') && steps.check-deps.outputs.ruby-deps == 'false'
416-
uses: ruby/setup-ruby@v1
416+
uses: ruby/setup-ruby@4dc28cf14d77b0afa6832d9765ac422dbf0dfedd # v1
417417
with:
418418
ruby-version: ${{ inputs.ruby-version }}
419419
bundler-cache: false

‎.github/instructions/github_workflows_yaml.instructions.md‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,18 @@
11
---
2-
applyTo: '.github/workflows/*.{yml,yaml}'
2+
applyTo: '.github/{actions,workflows}/**/*.{yml,yaml}'
33
description: 'Instructions for editing GitHub Actions workflows for this repository.'
44
---
55

6-
# Copilot Instructions for `.github/workflows/*.{yml,yaml}` files
6+
# Copilot Instructions for `.github/{actions,workflows}/**/*.{yml,yaml}` files
77

88
## PURPOSE
99

10-
This file contains instructions for working with GitHub Actions workflow files in the `.github/workflows/` directory of the `codeql-development-mcp-server` repository.
10+
This file contains instructions for working with GitHub Actions YAML files in the `.github/actions/` and `.github/workflows/` directories of the `codeql-development-mcp-server` repository.
1111

1212
## REQUIREMENTS
1313

1414
- **ALWAYS run `npm run build-and-test` from the repo root directory and ensure it passes completely before committing any changes. This is MANDATORY and must be verified before every commit.**
15+
- **ALWAYS pin ALL external GitHub Actions to full-length commit SHAs, never to tags or branch names — including GitHub-maintained `actions/*` actions.** Add a trailing comment with the original tag for readability (e.g., `uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6`). To resolve a tag to its underlying commit SHA (handling annotated tags correctly), run `git ls-remote https://github.com/OWNER/REPO.git refs/tags/TAG^{}`; for branch-based refs, use `refs/heads/BRANCH`.
1516
- ALWAYS use the principle of least privilege, and explicitly set `permissions` for workflows.
1617
- ALWAYS use valid YAML syntax and follow GitHub Actions workflow conventions.
1718
- ALWAYS follow best practices for GitHub Actions workflows including security, efficiency, and maintainability.
@@ -22,14 +23,14 @@ This file contains instructions for working with GitHub Actions workflow files i
2223

2324
## PREFERENCES
2425

25-
- PREFER using the latest stable versions of GitHub Actions (e.g., `actions/checkout@v6`, `actions/setup-node@v6`).
2626
- PREFER explicit permissions declarations using the `permissions` key for security.
2727
- PREFER descriptive step names that include the workflow context (e.g., "Lint and Format - Checkout repository").
2828
- PREFER matrix strategies for testing multiple versions when applicable.
2929
- PREFER adding summary outputs using `$GITHUB_STEP_SUMMARY` for better workflow visibility.
3030

3131
## CONSTRAINTS
3232

33+
- **NEVER reference an external GitHub Action by tag or branch name (e.g., `@v6`, `@main`). ALWAYS use the full 40-character commit SHA with a `# tag` comment.**
3334
- NEVER use overly broad permissions.
3435
- NEVER leave any trailing whitespace on any line.
3536
- NEVER use deprecated GitHub Actions or workflow syntax.

‎.github/skills/add-mcp-support-for-new-language/workflow-template.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,10 +44,10 @@ jobs:
4444

4545
steps:
4646
- name: Checkout repository
47-
uses: actions/checkout@v6
47+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
4848

4949
- name: Set up CodeQL CLI
50-
uses: github/codeql-action/init@v3
50+
uses: github/codeql-action/init@480db559a14342288b67e54bd959dd52dc3ee68f # v3
5151
with:
5252
languages: '{LANGUAGE}'
5353

‎.github/workflows/build-and-test-extension.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,10 +31,10 @@ jobs:
3131

3232
steps:
3333
- name: Checkout repository
34-
uses: actions/checkout@v6
34+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
3535

3636
- name: Setup Node.js environment
37-
uses: actions/setup-node@v6
37+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
3838
with:
3939
cache: 'npm'
4040
node-version-file: '.node-version'
@@ -64,7 +64,7 @@ jobs:
6464
install-language-runtimes: 'false'
6565

6666
- name: Cache VS Code for integration tests
67-
uses: actions/cache@v5
67+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
6868
with:
6969
key: vscode-test-${{ runner.os }}-stable
7070
path: extensions/vscode/.vscode-test

‎.github/workflows/build-server.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,10 +29,10 @@ jobs:
2929

3030
steps:
3131
- name: Build Server - Checkout repository
32-
uses: actions/checkout@v6
32+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
3333

3434
- name: Build Server - Setup Node.js environment
35-
uses: actions/setup-node@v6
35+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
3636
with:
3737
cache: 'npm'
3838
node-version-file: '.node-version'

‎.github/workflows/client-integration-tests.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -44,10 +44,10 @@ jobs:
4444

4545
steps:
4646
- name: MCP Integration Tests - Checkout repository
47-
uses: actions/checkout@v6
47+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
4848

4949
- name: MCP Integration Tests - Setup Node.js environment
50-
uses: actions/setup-node@v6
50+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
5151
with:
5252
cache: 'npm'
5353
node-version-file: '.node-version'
@@ -157,10 +157,10 @@ jobs:
157157

158158
steps:
159159
- name: CODEQL_PATH Tests - Checkout repository
160-
uses: actions/checkout@v6
160+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
161161

162162
- name: CODEQL_PATH Tests - Setup Node.js
163-
uses: actions/setup-node@v6
163+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
164164
with:
165165
cache: 'npm'
166166
node-version-file: '.node-version'

‎.github/workflows/copilot-setup-steps.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ jobs:
3636

3737
steps:
3838
- name: Copilot Setup - Checkout code
39-
uses: actions/checkout@v6
39+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
4040
## TODO : fix and/or rework to avoid "token not provided" error when this workflow
4141
## is initiated purely for use by Copilot Coding Agent (CCA) (i.e. not triggered
4242
## by normal code change). Uncomment the `with` section or refactor approach.
@@ -45,7 +45,7 @@ jobs:
4545
# token: ${{ secrets.QL_DEV_TOKEN }}
4646

4747
- name: Copilot Setup - Setup Node.js
48-
uses: actions/setup-node@v6
48+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
4949
with:
5050
cache: 'npm'
5151
node-version-file: '.node-version'
@@ -78,7 +78,7 @@ jobs:
7878
npm run bundle:server
7979
8080
- name: Copilot Setup - Cache VS Code for integration tests
81-
uses: actions/cache@v5
81+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
8282
with:
8383
key: vscode-test-${{ runner.os }}-stable
8484
path: extensions/vscode/.vscode-test

‎.github/workflows/dependency-review.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,9 @@ jobs:
1313
runs-on: ubuntu-latest
1414
steps:
1515
- name: Checkout repository
16-
uses: actions/checkout@v6
16+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
1717

1818
- name: Dependency Review
19-
uses: actions/dependency-review-action@v4
19+
uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4
2020
with:
2121
config-file: '.github/dependency-review-config.yml'

‎.github/workflows/lint-and-format.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,10 @@ jobs:
1717

1818
steps:
1919
- name: Lint and Format - Checkout repository
20-
uses: actions/checkout@v6
20+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2121

2222
- name: Lint and Format - Setup Node.js
23-
uses: actions/setup-node@v6
23+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
2424
with:
2525
cache: 'npm'
2626
node-version-file: '.node-version'

‎.github/workflows/query-unit-tests-swift.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,10 +33,10 @@ jobs:
3333

3434
steps:
3535
- name: Query Unit Tests - swift - Checkout repository
36-
uses: actions/checkout@v6
36+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
3737

3838
- name: Query Unit Tests - swift - Setup Node.js
39-
uses: actions/setup-node@v6
39+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
4040
with:
4141
cache: 'npm'
4242
node-version-file: '.node-version'

0 commit comments

Comments
 (0)