fix: pin 14 unpinned action(s) by dagecko · Pull Request #19872 · tailwindlabs/tailwindcss

dagecko · 2026-03-30T03:28:10Z

Re-submission of #19861. Had a problem with my fork and had to delete it, which closed the original PR. Apologies for the noise.

Summary

This PR pins all GitHub Actions to immutable commit SHAs instead of mutable version tags.

Pin 14 unpinned actions to full 40-character SHAs
Add version comments for readability

How to verify

Review the diff, each change is mechanical and preserves workflow behavior:

SHA pinning: action@v3 becomes action@abc123 # v3, original version preserved as comment
No workflow logic, triggers, or permissions are modified

I've been researching CI/CD supply chain attack vectors and submitting fixes to affected repos. Based on that research I built a scanner called Runner Guard and open sourced it here so you can scan yourself if you want to. I'll be posting more advisories over the next few weeks on Twitter if you want to stay in the loop.

If you have any questions, reach out. I'll be monitoring comms.

- Chris (dagecko)

coderabbitai · 2026-03-30T03:32:07Z

Walkthrough

This pull request updates GitHub Actions references across five CI/CD workflow files by pinning floating version tags to specific commit SHAs. The changes affect pnpm/action-setup, discord-actions/message, cross-platform-actions/action, and softprops/action-gh-release actions. Each pinned commit corresponds to the semantic version previously used, indicated by inline comments. No workflow logic, control flow, inputs, or environment variables were modified.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: pinning 14 GitHub Actions to commit SHAs instead of version tags for security purposes.
Description check	✅ Passed	The description is directly related to the changeset, explaining the rationale (supply chain security), the mechanical nature of changes, and how to verify them.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

🧹 Nitpick comments (1)

.github/workflows/release-insiders.yml (1)
80-80: Consider automating pin updates for long-term maintainability.

While SHA pinning significantly improves security, it requires periodic updates to receive security patches and new features from upstream actions. Consider enabling Dependabot or Renovate to automatically propose updates to pinned action commits.

Example .github/dependabot.yml configuration:
version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/release-insiders.yml at line 80, Add automated dependency
update tooling so pinned actions like the uses:
pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 entry are
periodically proposed for updates; create a Dependabot (or Renovate) config that
targets GitHub Actions (package-ecosystem: "github-actions") and a sensible
schedule (e.g., weekly) so PRs are opened to update SHA-pinned actions, or
enable Renovate with equivalent rules to keep pinned commits current.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In @.github/workflows/release-insiders.yml:
- Line 80: Add automated dependency update tooling so pinned actions like the
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 entry are
periodically proposed for updates; create a Dependabot (or Renovate) config that
targets GitHub Actions (package-ecosystem: "github-actions") and a sensible
schedule (e.g., weekly) so PRs are opened to update SHA-pinned actions, or
enable Renovate with equivalent rules to keep pinned commits current.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: db96916b-5f3b-4bcd-bc1d-c3860ec69aea

📥 Commits

Reviewing files that changed from the base of the PR and between d7fc281 and a8ec87f.

📒 Files selected for processing (5)

.github/workflows/ci.yml
.github/workflows/integration-tests.yml
.github/workflows/prepare-release.yml
.github/workflows/release-insiders.yml
.github/workflows/release.yml

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request. ### What changed? #### ✳️ eslint (9.29.0 → 9.30.1) · [Repo](https://github.com/eslint/eslint) · [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md) <details> <summary>Release Notes</summary> <h4><a href="https://github.com/eslint/eslint/releases/tag/v9.30.1">9.30.1</a></h4> <blockquote><h2 dir="auto">Bug Fixes</h2> <ul dir="auto"> <li> <a href="https://bounce.depfu.com/github.com/eslint/eslint/commit/e91bb870f8c6e38baa508f18048cd2a2d04b8b9c"><code class="notranslate">e91bb87</code></a> fix: allow separate default and named type imports (<a href="https://bounce.depfu.com/github.com/eslint/eslint/pull/19899">#19899</a>) (xbinaryx)</li> </ul> <h2 dir="auto">Documentation</h2> <ul dir="auto"> <li> <a href="https://bounce.depfu.com/github.com/eslint/eslint/commit/ab7c62598a9fca498e495d45029ae92fd5fb9bf3"><code class="notranslate">ab7c625</code></a> docs: Update README (GitHub Actions Bot)</li> <li> <a href="https://bounce.depfu.com/github.com/eslint/eslint/commit/dae1e5bb27db0e846efbe3026210013b42817838"><code class="notranslate">dae1e5b</code></a> docs: update jsdoc's link (<a href="https://bounce.depfu.com/github.com/eslint/eslint/pull/19896">#19896</a>) (JamesVanWaza)</li> </ul> <h2 dir="auto">Chores</h2> <ul dir="auto"> <li> <a href="https://bounce.depfu.com/github.com/eslint/eslint/commit/b035f747c6e6d1c7a299c90b0ed0b8109cf24a53"><code class="notranslate">b035f74</code></a> chore: upgrade to <code class="notranslate">@eslint/js@9.30.1</code> (<a href="https://bounce.depfu.com/github.com/eslint/eslint/pull/19906">#19906</a>) (Francesco Trotta)</li> <li> <a href="https://bounce.depfu.com/github.com/eslint/eslint/commit/b3dbc16563cb7036d75edff9814e17053a645321"><code class="notranslate">b3dbc16</code></a> chore: package.json update for @eslint/js release (Jenkins)</li> </ul></blockquote> <h4><a href="https://github.com/eslint/eslint/releases/tag/v9.30.0">9.30.0</a></h4> <blockquote><h2 dir="auto">Features</h2> <ul dir="auto"> <li> <a href="https://bounce.depfu.com/github.com/eslint/eslint/commit/52a5fcaa4e0bb4e55c014c20ed47d6c93b107635"><code class="notranslate">52a5fca</code></a> feat: Support <code class="notranslate">basePath</code> property in config objects (<a href="https://bounce.depfu.com/github.com/eslint/eslint/pull/19879">#19879</a>) (Milos Djermanovic)</li> <li> <a href="https://bounce.depfu.com/github.com/eslint/eslint/commit/4ab44823df4d4b47d3650da949077a0551e7579e"><code class="notranslate">4ab4482</code></a> feat: add <code class="notranslate">allowSeparateTypeImports</code> option to <code class="notranslate">no-duplicate-imports</code> (<a href="https://bounce.depfu.com/github.com/eslint/eslint/pull/19872">#19872</a>) (sethamus)</li> <li> <a href="https://bounce.depfu.com/github.com/eslint/eslint/commit/b8a7e7aeb5f0ed2e1670771ab4dda6fd723d96eb"><code class="notranslate">b8a7e7a</code></a> feat: throw error when column is negative in <code class="notranslate">getIndexFromLoc</code> (<a href="https://bounce.depfu.com/github.com/eslint/eslint/pull/19831">#19831</a>) (루밀LuMir)</li> </ul> <h2 dir="auto">Bug Fixes</h2> <ul dir="auto"> <li> <a href="https://bounce.depfu.com/github.com/eslint/eslint/commit/6a0f164543bf8461d6a27a740c9e08aa77cbe42d"><code class="notranslate">6a0f164</code></a> fix: handle <code class="notranslate">null</code> type <code class="notranslate">loc</code> in <code class="notranslate">getIndexFromLoc</code> method (<a href="https://bounce.depfu.com/github.com/eslint/eslint/pull/19862">#19862</a>) (루밀LuMir)</li> <li> <a href="https://bounce.depfu.com/github.com/eslint/eslint/commit/3fbcd704a0b2aef2a6c1fc34d2bc4b35f6425067"><code class="notranslate">3fbcd70</code></a> fix: update error message for <code class="notranslate">no-restricted-properties</code> (<a href="https://bounce.depfu.com/github.com/eslint/eslint/pull/19855">#19855</a>) (Tanuj Kanti)</li> <li> <a href="https://bounce.depfu.com/github.com/eslint/eslint/commit/7ef4cf76610d42727a404e495ac6d47868cf5040"><code class="notranslate">7ef4cf7</code></a> fix: remove unnecessary semicolon from fixes (<a href="https://bounce.depfu.com/github.com/eslint/eslint/pull/19857">#19857</a>) (Francesco Trotta)</li> <li> <a href="https://bounce.depfu.com/github.com/eslint/eslint/commit/7dabc38a8406d470fb2389eec2f0ad1ad214173e"><code class="notranslate">7dabc38</code></a> fix: use <code class="notranslate">process.version</code> in <code class="notranslate">--env-info</code> (<a href="https://bounce.depfu.com/github.com/eslint/eslint/pull/19865">#19865</a>) (TKDev7)</li> </ul> <h2 dir="auto">Documentation</h2> <ul dir="auto"> <li> <a href="https://bounce.depfu.com/github.com/eslint/eslint/commit/8662ed1f6debc358e22812b145e117aa4a907d78"><code class="notranslate">8662ed1</code></a> docs: adopt eslint-stylistic sub packages related changes (<a href="https://bounce.depfu.com/github.com/eslint/eslint/pull/19887">#19887</a>) (ntnyq)</li> <li> <a href="https://bounce.depfu.com/github.com/eslint/eslint/commit/20158b09db3430cf00b202ba8c25ce874bbaf00a"><code class="notranslate">20158b0</code></a> docs: typo in comment for unused variables handling (<a href="https://bounce.depfu.com/github.com/eslint/eslint/pull/19870">#19870</a>) (leopardracer)</li> <li> <a href="https://bounce.depfu.com/github.com/eslint/eslint/commit/ebfb5b46136c4d737c9783333e3057421d1a0bef"><code class="notranslate">ebfb5b4</code></a> docs: Fixed Typo in configuration-files.md (<a href="https://bounce.depfu.com/github.com/eslint/eslint/pull/19873">#19873</a>) (0-20)</li> <li> <a href="https://bounce.depfu.com/github.com/eslint/eslint/commit/4112fd09531092e9651e9981205bcd603dc56acf"><code class="notranslate">4112fd0</code></a> docs: clarify that boolean is still allowed for rule <code class="notranslate">meta.deprecated</code> (<a href="https://bounce.depfu.com/github.com/eslint/eslint/pull/19866">#19866</a>) (Bryan Mishkin)</li> </ul> <h2 dir="auto">Chores</h2> <ul dir="auto"> <li> <a href="https://bounce.depfu.com/github.com/eslint/eslint/commit/2b6491cd4b8eec44d4a3f8dea1b71151e8dd0230"><code class="notranslate">2b6491c</code></a> chore: upgrade to <code class="notranslate">@eslint/js@9.30.0</code> (<a href="https://bounce.depfu.com/github.com/eslint/eslint/pull/19889">#19889</a>) (Francesco Trotta)</li> <li> <a href="https://bounce.depfu.com/github.com/eslint/eslint/commit/5a5d5261037fdf84a91f2f22d3726d58572453f4"><code class="notranslate">5a5d526</code></a> chore: package.json update for @eslint/js release (Jenkins)</li> <li> <a href="https://bounce.depfu.com/github.com/eslint/eslint/commit/eaf8a418af32b3190494e4a2284533353c28ccfa"><code class="notranslate">eaf8a41</code></a> chore: Correct typos in linter tests (<a href="https://bounce.depfu.com/github.com/eslint/eslint/pull/19878">#19878</a>) (kilavvy)</li> </ul></blockquote> <p><em>Does any of this look wrong? <a href="https://depfu.com/packages/npm/eslint/feedback">Please let us know.</a></em></p> </details> <details> <summary>Commits</summary> <p><a href="https://github.com/eslint/eslint/compare/edf232b680390013c68f081a5e41843bcf2dd18f...6769b5fa11ecfb2c2cf78472d3d90564a1e01d3c">See the full diff on Github</a>. The new version differs by 23 commits:</p> <ul> <li><a href="https://github.com/eslint/eslint/commit/6769b5fa11ecfb2c2cf78472d3d90564a1e01d3c"><code>9.30.1</code></a></li> <li><a href="https://github.com/eslint/eslint/commit/b2950ace77663f96cab395b5fe525054d3f49bfe"><code>Build: changelog update for 9.30.1</code></a></li> <li><a href="https://github.com/eslint/eslint/commit/b035f747c6e6d1c7a299c90b0ed0b8109cf24a53"><code>chore: upgrade to `@eslint/js@9.30.1` (tailwindlabs#19906)</code></a></li> <li><a href="https://github.com/eslint/eslint/commit/b3dbc16563cb7036d75edff9814e17053a645321"><code>chore: package.json update for @eslint/js release</code></a></li> <li><a href="https://github.com/eslint/eslint/commit/e91bb870f8c6e38baa508f18048cd2a2d04b8b9c"><code>fix: allow separate default and named type imports (tailwindlabs#19899)</code></a></li> <li><a href="https://github.com/eslint/eslint/commit/ab7c62598a9fca498e495d45029ae92fd5fb9bf3"><code>docs: Update README</code></a></li> <li><a href="https://github.com/eslint/eslint/commit/dae1e5bb27db0e846efbe3026210013b42817838"><code>docs: update jsdoc&tailwindlabs#39;s link (tailwindlabs#19896)</code></a></li> <li><a href="https://github.com/eslint/eslint/commit/ad1d63951773acc7828bcc1eafbb731567447298"><code>9.30.0</code></a></li> <li><a href="https://github.com/eslint/eslint/commit/c02d70b71867b4cee9c38a536f74e98e3b810f16"><code>Build: changelog update for 9.30.0</code></a></li> <li><a href="https://github.com/eslint/eslint/commit/2b6491cd4b8eec44d4a3f8dea1b71151e8dd0230"><code>chore: upgrade to `@eslint/js@9.30.0` (tailwindlabs#19889)</code></a></li> <li><a href="https://github.com/eslint/eslint/commit/5a5d5261037fdf84a91f2f22d3726d58572453f4"><code>chore: package.json update for @eslint/js release</code></a></li> <li><a href="https://github.com/eslint/eslint/commit/52a5fcaa4e0bb4e55c014c20ed47d6c93b107635"><code>feat: Support `basePath` property in config objects (tailwindlabs#19879)</code></a></li> <li><a href="https://github.com/eslint/eslint/commit/6a0f164543bf8461d6a27a740c9e08aa77cbe42d"><code>fix: handle `null` type `loc` in `getIndexFromLoc` method (tailwindlabs#19862)</code></a></li> <li><a href="https://github.com/eslint/eslint/commit/8662ed1f6debc358e22812b145e117aa4a907d78"><code>docs: adopt eslint-stylistic sub packages related changes (tailwindlabs#19887)</code></a></li> <li><a href="https://github.com/eslint/eslint/commit/eaf8a418af32b3190494e4a2284533353c28ccfa"><code>chore: Correct typos in linter tests (tailwindlabs#19878)</code></a></li> <li><a href="https://github.com/eslint/eslint/commit/4ab44823df4d4b47d3650da949077a0551e7579e"><code>feat: add `allowSeparateTypeImports` option to `no-duplicate-imports` (tailwindlabs#19872)</code></a></li> <li><a href="https://github.com/eslint/eslint/commit/3fbcd704a0b2aef2a6c1fc34d2bc4b35f6425067"><code>fix: update error message for `no-restricted-properties` (tailwindlabs#19855)</code></a></li> <li><a href="https://github.com/eslint/eslint/commit/20158b09db3430cf00b202ba8c25ce874bbaf00a"><code>docs: typo in comment for unused variables handling (tailwindlabs#19870)</code></a></li> <li><a href="https://github.com/eslint/eslint/commit/ebfb5b46136c4d737c9783333e3057421d1a0bef"><code>docs: Fixed Typo in configuration-files.md (tailwindlabs#19873)</code></a></li> <li><a href="https://github.com/eslint/eslint/commit/b8a7e7aeb5f0ed2e1670771ab4dda6fd723d96eb"><code>feat: throw error when column is negative in `getIndexFromLoc` (tailwindlabs#19831)</code></a></li> <li><a href="https://github.com/eslint/eslint/commit/7ef4cf76610d42727a404e495ac6d47868cf5040"><code>fix: remove unnecessary semicolon from fixes (tailwindlabs#19857)</code></a></li> <li><a href="https://github.com/eslint/eslint/commit/7dabc38a8406d470fb2389eec2f0ad1ad214173e"><code>fix: use `process.version` in `--env-info` (tailwindlabs#19865)</code></a></li> <li><a href="https://github.com/eslint/eslint/commit/4112fd09531092e9651e9981205bcd603dc56acf"><code>docs: clarify that boolean is still allowed for rule `meta.deprecated` (tailwindlabs#19866)</code></a></li> </ul> </details> --- ![Depfu Status](https://depfu.com/badges/edd6acd35d74c8d41cbb540c30442adf/stats.svg) [Depfu](https://depfu.com) will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with `@depfu rebase`. <details><summary>All Depfu comment commands</summary> <blockquote><dl> <dt>@depfu rebase</dt><dd>Rebases against your default branch and redoes this update</dd> <dt>@depfu recreate</dt><dd>Recreates this PR, overwriting any edits that you've made to it</dd> <dt>@depfu merge</dt><dd>Merges this PR once your tests are passing and conflicts are resolved</dd> <dt>@depfu cancel merge</dt><dd>Cancels automatic merging of this PR</dd> <dt>@depfu close</dt><dd>Closes this PR and deletes the branch</dd> <dt>@depfu reopen</dt><dd>Restores the branch and reopens this PR (if it's closed)</dd> <dt>@depfu pause</dt><dd>Ignores all future updates for this dependency and closes this PR</dd> <dt>@depfu pause [minor|major]</dt><dd>Ignores all future minor/major updates for this dependency and closes this PR</dd> <dt>@depfu resume</dt><dd>Future versions of this dependency will create PRs again (leaves this PR as is)</dd> </dl></blockquote> </details> Co-authored-by: depfu[bot] <23717796+depfu[bot]@users.noreply.github.com>

fix: pin 14 unpinned action(s)

a8ec87f

dagecko requested a review from a team as a code owner March 30, 2026 03:28

coderabbitai bot reviewed Mar 30, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: pin 14 unpinned action(s)#19872

fix: pin 14 unpinned action(s)#19872
dagecko wants to merge 1 commit intotailwindlabs:mainfrom
dagecko:runner-guard/fix-ci-security

dagecko commented Mar 30, 2026

Uh oh!

coderabbitai bot commented Mar 30, 2026

Uh oh!

coderabbitai bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dagecko commented Mar 30, 2026

Summary

How to verify

Uh oh!

coderabbitai bot commented Mar 30, 2026

Walkthrough

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant