Skip to content

ci: pin GitHub Actions to full commit SHA #16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
arai-ta merged 1 commit into from
Jan 28, 2026
Merged

ci: pin GitHub Actions to full commit SHA #16

arai-ta merged 1 commit into from
Jan 28, 2026

Conversation

@tasuku43
Copy link
Contributor

@tasuku43 tasuku43 commented Jan 28, 2026 •
edited
Loading

Summary

Updated GitHub Actions / reusable workflow references from tag/branch notation (e.g., @v4, @v2) to full commit SHA pinning (automated via pinact).

Background / Purpose

  • Supply chain security: Reduces risk if a referenced tag is re-pointed to a different SHA in the future
  • Reproducibility: Ensures the same workflow always executes the exact same action version

Scope of Changes

  • Workflow definitions only (no application code or configuration changes)

@tasuku43 tasuku43 force-pushed the chore/pin-github-actions branch from 43441d4 to fafa643 Compare January 28, 2026 05:52
@tasuku43 tasuku43 requested a review from arai-ta January 28, 2026 05:54
@arai-ta arai-ta merged commit 1c6fb86 into master Jan 28, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@arai-ta arai-ta Awaiting requested review from arai-ta

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@tasuku43 @arai-ta