chore(repo): pin GitHub Actions to SHAs and drop persisted tokens by jacekradko · Pull Request #8632 · clerk/javascript

jacekradko · 2026-05-22T19:42:42Z

This is the repo-wide follow-up to a security finding that flagged a single workflow for using mutable action tags and leaving GITHUB_TOKEN persisted in .git/config after actions/checkout. Fixing one file would have left the broader posture unchanged, so this PR addresses the whole .github/ surface in one pass.

Three coordinated pieces:

Every third-party action under .github/workflows/** and .github/actions/** is now pinned to an immutable commit SHA, with the original tag preserved as a # v4 comment. 73 uses: references across 12 workflows and 4 composite actions.
Renovate's includePaths now covers .github/**, and a new package rule applies pinDigests: true plus a GitHub Actions group, so the SHAs stay current automatically and won't quietly rot. renovate.json5 is regenerated from scripts/renovate-config-generator.mjs; do not hand-edit.
persist-credentials: false is set on every actions/checkout that doesn't need the persisted token (20 sites). The one site that does, release.yml line 45, is intentionally left alone: it sets token: explicitly so changesets/action can push the Version PR back to the repo. The existing comment block above that token: input already documents why.

step-security/harden-runner would be the natural next layer but needs an audit-mode rollout before enforcement, deferred to a separate PR.

Convert every `uses:` reference in `.github/workflows/**` and `.github/actions/**` from a mutable tag to an immutable commit SHA, with the tag preserved as a trailing comment so the version is still readable. Extend the Renovate config generator to manage the `.github/**` paths (previously outside `includePaths`) with `pinDigests: true`, so the SHAs stay current automatically. Set `persist-credentials: false` on every `actions/checkout` step that does not require the persisted `GITHUB_TOKEN`. The release job in `release.yml` is intentionally left alone: it sets a `token:` input explicitly so `changesets/action` can push the Version PR.

vercel · 2026-05-22T19:42:48Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	May 22, 2026 7:43pm

changeset-bot · 2026-05-22T19:42:50Z

🦋 Changeset detected

Latest commit: aa7e007

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

pkg-pr-new · 2026-05-22T19:46:04Z

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8632

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8632

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8632

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8632

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8632

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8632

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8632

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8632

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8632

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8632

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8632

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8632

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8632

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8632

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8632

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8632

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8632

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8632

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8632

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8632

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8632

commit: aa7e007

coderabbitai · 2026-05-22T19:47:18Z

📝 Walkthrough

Walkthrough

This pull request systematically hardens the repository's GitHub Actions infrastructure by pinning all action dependencies to specific commit SHAs instead of using floating version tags. The changeset introduces this hardening across reusable composite actions and all GitHub workflows. Renovate is configured to automatically manage digest pinning for GitHub Actions updates. Several checkout steps now explicitly set persist-credentials: false to prevent credential persistence. The changes affect 18 workflow files, 3 reusable actions, and configuration files, ensuring reproducible and secure action execution across CI/CD pipelines.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately and concisely describes the main security-focused changes: pinning GitHub Actions to immutable SHAs and removing persisted credentials.
Description check	✅ Passed	The description is directly related to the changeset, providing clear context about the security finding and detailing the three coordinated remediation pieces with specific counts and locations.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/ci.yml (1)
443-457: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Remove secret logging from the cert-writing script (security blocker).

At Line 452, console.log('rootCa', rootCa); logs data coming from INTEGRATION_ROOT_CA (a GitHub secret). This can leak sensitive material to workflow logs and must be removed before merge.
Suggested fix
-            console.log('rootCa', rootCa);
             fs.writeFileSync(path.join(process.env.GITHUB_WORKSPACE, 'integration/certs', 'rootCA.pem'), rootCa);
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 443 - 457, Remove the secret logging
by deleting the console.log that prints the INTEGRATION_ROOT_CA value: remove
the line that calls console.log('rootCa', rootCa) in the actions/github-script
block so secrets (rootCa and any certs) are not written to workflow logs; keep
the fs.writeFileSync calls (path.join(..., 'integration/certs', 'rootCA.pem')
and the loop writing cert files) but do not emit their contents to console.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/workflows/ci.yml:
- Around line 443-457: Remove the secret logging by deleting the console.log
that prints the INTEGRATION_ROOT_CA value: remove the line that calls
console.log('rootCa', rootCa) in the actions/github-script block so secrets
(rootCa and any certs) are not written to workflow logs; keep the
fs.writeFileSync calls (path.join(..., 'integration/certs', 'rootCA.pem') and
the loop writing cert files) but do not emit their contents to console.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 5a25bc4d-ee01-489b-9368-46570b84b532

📥 Commits

Reviewing files that changed from the base of the PR and between a036ce8 and aa7e007.

📒 Files selected for processing (18)

.changeset/harden-gh-actions.md
.github/actions/ensure-stable-pr/action.yml
.github/actions/init-blacksmith/action.yml
.github/actions/init/action.yml
.github/workflows/ci.yml
.github/workflows/e2e-cleanups.yml
.github/workflows/e2e-staging.yml
.github/workflows/labeler.yml
.github/workflows/lock-threads.yml
.github/workflows/major-version-check.yml
.github/workflows/mobile-e2e.yml
.github/workflows/nightly-checks.yml
.github/workflows/pr-title-linter.yml
.github/workflows/release-preflight.yml
.github/workflows/release.yml
.github/workflows/validate-renovate-config.yml
renovate.json5
scripts/renovate-config-generator.mjs

github-actions Bot added the actions label May 22, 2026

vercel Bot deployed to Preview May 22, 2026 19:43 View deployment

jacekradko requested a review from dominic-clerk May 22, 2026 19:46

coderabbitai Bot reviewed May 22, 2026

View reviewed changes

jacekradko mentioned this pull request May 22, 2026

ci(repo): dogfood snapi api checks #8621

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(repo): pin GitHub Actions to SHAs and drop persisted tokens#8632

chore(repo): pin GitHub Actions to SHAs and drop persisted tokens#8632
jacekradko wants to merge 1 commit into
mainfrom
jacek/harden-gh-actions

jacekradko commented May 22, 2026

Uh oh!

vercel Bot commented May 22, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented May 22, 2026

Uh oh!

pkg-pr-new Bot commented May 22, 2026

Uh oh!

coderabbitai Bot commented May 22, 2026

Walkthrough

Estimated code review effort

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

jacekradko commented May 22, 2026

Uh oh!

vercel Bot commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented May 22, 2026

🦋 Changeset detected

Uh oh!

pkg-pr-new Bot commented May 22, 2026

Uh oh!

coderabbitai Bot commented May 22, 2026

Walkthrough

Estimated code review effort

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented May 22, 2026 •

edited

Loading