From 9d7c2c7665c530fd019e9017d6ebc4cb62a3911f Mon Sep 17 00:00:00 2001 From: Matthew Blode Date: Sun, 4 Oct 2026 18:28:26 +1100 Subject: [PATCH] Pin GitHub Actions to commit SHAs in CI and publish workflows npm-publish.yml carries contents: write and id-token: write alongside tag-pinned actions, so a moved tag could run arbitrary code during a publish. Pin every uses: in ci.yml and npm-publish.yml to a full commit SHA with a version comment. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_017xivnFFxtKVFiyV9LCGX9z --- .github/workflows/ci.yml | 4 ++-- .github/workflows/npm-publish.yml | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 38e0503..982bce5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,12 +17,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 - name: Setup Node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: "lts/*" cache: npm diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index be7bdd2..d876c51 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -16,12 +16,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 - name: Set up Node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 24 registry-url: https://registry.npmjs.org @@ -34,7 +34,7 @@ jobs: run: npm ci - name: Create release PR or publish - uses: changesets/action@v1 + uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0 with: publish: npm run release env: