Pin GitHub Actions to full-length commit SHAs

[Dan Fiedler (danfiedler-msft)]

Summary

This PR pins GitHub Actions to full-length commit SHAs for improved security and reproducibility and adds a 7 day cooldown to Dependabot configuration for GitHub Actions. This work is described in more detail at https://aka.ms/action-pinning.

Why?

Pinning actions to commit SHAs prevents supply-chain attacks where a tag could be moved to point to malicious code. This is a recommended security best practice per the GitHub Actions security hardening guide.

This change mitigates the risk of tag retargeting to malicious code as seen in incidents like the tj-actions/changed-files action compromise or codfish/semantic-release-action compromise and improves the integrity and reproducibility of the CI/CD pipeline.

What changed?

Action pinning: Third-party action references in .github/workflows/ that used mutable tag-based references (e.g., actions/checkout@v4) have been updated to full-length commit SHAs with a version comment (e.g., actions/checkout@<sha> # v4) using the pinact tool. References that were already pinned to a SHA, or that used immutable release tags, were left unchanged.

Dependabot configuration: .github/dependabot.yml has been updated to ensure a github-actions package-ecosystem section is present with a cooldown configuration (default-days: 7). If the file did not exist, it was created. If a github-actions section already existed, only the cooldown block was added or its default-days value was increased to 7 if it was lower. The 7-day cooldown provides a window for the community to detect and report compromised releases before they are automatically proposed as updates, reducing exposure to supply-chain attacks via newly published malicious versions.

Is this safe to merge?

Yes. The pinned SHAs correspond to the same commits that the existing tags pointed to. No behavioral changes in action execution are introduced. You can verify the pinned SHA value using the GitHub REST API (e.g., the commit hash for actions/checkout@v7 can be found in the sha property in the JSON response for GET https://api.github.com/repos/actions/checkout/commits/v7).

Additional Information

For more information, please see https://aka.ms/action-pinning

[Heejae Chang (heejaechang)]

🔒 Automated review in progress — Heejae Chang (@heejaechang) is auto-reviewing this PR.

[Heejae Chang (heejaechang)]

Result: 🔴 could-not-verify

Verification details

Verification: Isolated verification failed: Repository formatting check on changed YAML files. The relevant tests could not be fully run in the isolated environment; this review is not fully verified.

Summary: Three static checks passed: all eight changed YAML files parsed, all 86 remote action references used full-length SHAs, and all four GitHub Actions Dependabot entries specified a seven-day cooldown. The targeted repository formatting check failed on `.github/dependabot.yml`, which loses its final newline in this PR. The PR adds no tests. Upstream SHA/tag equivalence and actual GitHub Actions execution could not be verified in the network-disabled container.

Test runs: 3 passed, 1 failed, 1 not run

• ❌ Failed | PR-related | Repository formatting check on changed YAML files | node ./node_modules/prettier/bin-prettier.js --check .github/actions/build-vsix/action.yml .github/actions/lint/action.yml .github/actions/smoke-tests/action.yml .github/dependabot.yml .github/workflows/build.yml .github/workflows/codeql-analysis.yml .github/workflows/gen-issue-velocity.yml .github/workflows/pr-check.yml
• ⚠️ Not run | Upstream SHA/tag equivalence and workflow execution
• ✅ Passed | Dependency and targeted test discovery | printf 'Sandbox profile: %s\n' "$AUTOMATION_SANDBOX_PROFILE"; git log -2 --oneline; git diff HEAD^ HEAD --stat; python - <<'PY'
import importlib.util, json, pathlib, shutil
for tool in ('python', 'node', 'npm', 'actionlint', 'pinact'):
print(f'{tool}: {shutil.which(tool)}')
print('PyYAML available:', importlib.util.find_spec('yaml') is not None)
print('node_modules present:', pathlib.Path('node_modules').is_dir())
p = json.loads(pathlib.Path('package.json').read_text())
print('Package scripts:', json.dumps(p.get('scripts', {}), indent=2))
print('Relevant dependency entries:', {k:v for section in ('dependencies','devDependencies') for k,v in p.get(section,{}).items() if any(s in k.lower() for s in ('yaml','lint','test','mocha'))})
print('Lockfiles:', [str(p) for p in pathlib.Path('.').glob('lock')])
for root in ('build', 'src/test', '.github'):
matches = [str(p) for p in pathlib.Path(root).rglob('*') if p.is_file() and any(s in p.name.lower() for s in ('workflow','dependabot','actionlint','pinning'))]
print(f'Related test/config paths under {root}:', matches[:30])
PY
• ✅ Passed | Offline dependency preparation | npm ci --offline --ignore-scripts --no-audit --no-fund
• ✅ Passed | YAML, full-length action pins, and cooldown checks | python - <<'PY'
from collections import Counter
from pathlib import Path
import re
import unittest
import yaml

CHANGED = [
'.github/actions/build-vsix/action.yml',
'.github/actions/lint/action.yml',
'.github/actions/smoke-tests/action.yml',
'.github/dependabot.yml',
'.github/workflows/build.yml',
'.github/workflows/codeql-analysis.yml',
'.github/workflows/gen-issue-velocity.yml',
'.github/workflows/pr-check.yml',
]
EXPECTED = {
('actions/setup-node', '949feb2413d6458794dcd2491c4babbbce0c15c1'): 5,
('actions/setup-python', '5fda3b95a4ea91299a34e894583c3862153e4b97'): 10,
('dtolnay/rust-toolchain', '7e38f4b43b4db5c8dd498af069a4f6196df1d067'): 4,
('actions/setup-node', '49933ea5288caeca8642d1e84afbd3f7d6820020'): 1,
('actions/setup-python', 'a26af69be951a213d495a4c3e4e4022e16d87065'): 1,
('actions/download-artifact', 'd3f86a106a0bac45b974a628896c90dbdf5c8093'): 1,
('github/codeql-action/init', 'cdf488f595d80d6e07e03d4674febd5ab45fa938'): 1,
('github/codeql-action/analyze', 'cdf488f595d80d6e07e03d4674febd5ab45fa938'): 1,
}

class UniqueLoader(yaml.BaseLoader):
def construct_mapping(self, node, deep=False):
result = {}
for key_node, value_node in node.value:
key = self.construct_object(key_node, deep=deep)
if key in result:
raise ValueError(f'Duplicate YAML key: {key}')
result[key] = self.construct_object(value_node, deep=deep)
return result

class ActionPinningChecks(unittest.TestCase):
def test_changed_yaml_parses_without_duplicate_keys(self):
for filename in CHANGED:
with self.subTest(filename=filename):
doc = yaml.load(Path(filename).read_text(), Loader=UniqueLoader)
self.assertIsInstance(doc, dict)
if '/workflows/' in filename:
self.assertIn('on', doc)
self.assertIn('jobs', doc)
elif '/actions/' in filename:
self.assertEqual(doc['runs']['using'], 'composite')
self.assertIsInstance(doc['runs']['steps'], list)
print('Validated all 8 changed YAML documents.')

def test_remote_action_references_are_full_shas(self):
    seen = Counter()
    total = 0
    files = list(Path('.github/workflows').glob('*.yml')) + list(Path('.github/actions').rglob('action.yml'))
    for path in files:
        for line in path.read_text().splitlines():
            match = re.match(r'^\s*(?:-\s*)?uses:\s*([^\s#]+)', line)
            if not match or match[1].startswith(('./', 'docker://')):
                continue
            action, sep, ref = match[1].partition('@')
            with self.subTest(path=str(path), reference=match[1]):
                self.assertEqual(sep, '@')
                self.assertRegex(ref, r'^[0-9a-f]{40}$')
                if (action, ref) in EXPECTED:
                    self.assertRegex(line, r' # v\S+')
                    seen[(action, ref)] += 1
            total += 1
    self.assertEqual(seen, Counter(EXPECTED))
    print(f'Validated {total} remote action references; all 24 changed references have expected SHAs and version comments.')

def test_all_github_actions_entries_have_seven_day_cooldown(self):
    config = yaml.safe_load(Path('.github/dependabot.yml').read_text())
    self.assertEqual(config['version'], 2)
    actions = [entry for entry in config['updates'] if entry['package-ecosystem'] == 'github-actions']
    self.assertEqual(len(actions), 4)
    for entry in actions:
        with self.subTest(directory=entry['directory']):
            self.assertEqual(entry['cooldown'], {'default-days': 7})
            self.assertEqual(entry['schedule'], {'interval': 'daily'})
            self.assertEqual(entry['labels'], ['no-changelog'])
    pip = [entry for entry in config['updates'] if entry['package-ecosystem'] == 'pip']
    self.assertEqual(len(pip), 1)
    self.assertNotIn('cooldown', pip[0])
    print('Validated 7-day cooldown on all 4 GitHub Actions entries; pip entry has no cooldown.')

unittest.main(verbosity=2)
PY

❌ Repository formatting check on changed YAML files diagnostic output

Checking formatting...
.github/dependabot.yml
Code style issues found in the above file(s). Forgot to run Prettier?
[container exit=1]

⚠️ Upstream SHA/tag equivalence and workflow execution diagnostic output

The container has no network access, actionlint, or pinact. Static checks establish SHA syntax and configured cooldown values, not upstream commit identity or GitHub-hosted execution.