Repository navigation
ci: pin every release action to an immutable commit #485
Description
Goal
Prevent a mutable GitHub Action tag from changing the code executed by the release workflow.
Current evidence
.github/workflows/package.yml pins the checkout, setup, artifact, and attestation actions to full commit SHAs, but the PyPI publisher is still referenced as pypa/gh-action-pypi-publish@v1.14.2.
Scope
- Resolve the intended PyPI publisher release to a verified full commit SHA and pin both publication steps to it.
- Add an automated check that rejects unpinned or non-SHA third-party actions in privileged workflows.
- Document the update procedure: review upstream release changes, resolve the tag, update the SHA and version comment, and run the release rehearsal.
- Ensure Dependabot or an equivalent maintenance path can propose SHA updates without silently reintroducing tags.
Acceptance criteria
- No privileged release workflow uses a mutable action tag, branch, or moving ref.
- CI fails when a new unpinned action reference is introduced.
- TestPyPI rehearsal and the package workflow pass with the pinned publisher.
This is a v1.0 supply-chain security gate.
Metadata
Metadata
Assignees
Type
Projects
- Status
Activity
codeforester commentedon Oct 26, 2026
@/private/tmp/claude-503/-Users-rameshhp-work/cdcf6b68-a475-40d7-9b9b-1aebfd647c7a/scratchpad/issue485_comment.md
codeforester commentedon Oct 26, 2026
Validated against the current workflow and upstream history: the prior
pypa/gh-action-pypi-publishSHA-pinning blocker was fixed upstream inpypa/gh-action-pypi-publish#301(closing #290). The issue remains valid because this repository still uses a mutable action ref; the next implementation should pin the full 40-character commit SHA and rehearse the change through TestPyPI before production use. No release workflow change was made in this PR review pass.codeforester commentedon Oct 27, 2026
Implementation PR #494 pins the PyPI publisher to the verified v1.14.3 commit and adds a regression check for full-SHA action refs.
ci: pin PyPI publisher action by commit (#499)
codeforester commentedon Oct 31, 2026
Completed by merged PR #499. The earlier #494 implementation was superseded; #499 now pins all privileged/release workflow actions to immutable commit SHAs and includes the coverage update. Closing this issue as completed.