Pin every action to a commit, keeping the tag as a comment - #22
Merged
Merged
Conversation
A tag is a label somebody else can move. `actions/checkout@v7` means whatever the owner of that repository decides v7 points at, at the moment the workflow runs, and these workflows run with a token that can write here. `pypa/gh-action-pypi-publish@release/v1` was worse: a branch, which moves by design, on the step that publishes to PyPI. Pinning fixes what runs. The tag stays on the line as a comment, so the file still reads, and Dependabot understands this form -- it raises the commit and rewrites the comment together, which is what keeps this from becoming a snapshot that rots. Every commit was resolved through the API rather than typed, and all twenty-three distinct references were checked against it again afterwards. The rewrite is idempotent: a second run reports nothing to do.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A tag is a label somebody else can move, and these workflows run with a token that can write here.
pypa/gh-action-pypi-publish@release/v1was a branch — it moves by design — on the step that publishes to PyPI.The tag stays as a trailing comment, which is the form Dependabot maintains: it raises the commit and the comment together.
github-actionsis already in this repository'sdependabot.yml.Done with
scripts/pin_actions.pyin the.githubrepository. Every commit resolved through the API rather than typed, and all 23 distinct references re-checked against it afterwards — zero mismatches.Proven first on DrobyshevDev/stadion#8, where the full matrix went green on pinned actions across five interpreters and three operating systems.
Why it matters beyond hygiene:
Pinned-Dependenciesis scoring 0 on the OpenSSF Scorecard badge these READMEs now carry, and it is the heaviest single check. mlango, for example, sits at 6.3 with that at zero.