Skip to content

Commit 5d552d2

Browse files
zachdunnclaude
zachdunn
and
claude
authored
chore(ci): pin GitHub Actions to commit SHAs (#596)
* chore(ci): pin GitHub Actions to commit SHAs Tags are mutable — a compromised action maintainer can silently retarget an existing tag. Pinning to full commit SHAs (with a trailing version comment for grep-ability) closes that supply-chain hole, per GitHub's hardening guide and OpenSSF Scorecard's Pinned-Dependencies check. Adds a Dependabot config grouped into a single weekly PR so SHA bumps land as reviewable updates instead of stale pins. Closes #567. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore(ci): add bun ecosystem to Dependabot Bun's text lockfile already pins every package by sha512 integrity hash, and every CI install runs with --frozen-lockfile. The remaining gap was getting upstream version drift surfaced as PRs. Adding the bun ecosystem to the existing Dependabot config groups production and dev dependency bumps into two weekly PRs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 parent 64f46af commit 5d552d2

8 files changed

Lines changed: 57 additions & 31 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "github-actions"
4+
directory: "/"
5+
schedule:
6+
interval: "weekly"
7+
groups:
8+
actions:
9+
patterns:
10+
- "*"
11+
- package-ecosystem: "bun"
12+
directory: "/"
13+
schedule:
14+
interval: "weekly"
15+
open-pull-requests-limit: 10
16+
groups:
17+
production-deps:
18+
dependency-type: "production"
19+
update-types:
20+
- "minor"
21+
- "patch"
22+
dev-deps:
23+
dependency-type: "development"
24+
update-types:
25+
- "minor"
26+
- "patch"

‎.github/workflows/ci.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,9 @@ jobs:
1212
runs-on: ubuntu-latest
1313

1414
steps:
15-
- uses: actions/checkout@v6
15+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1616

17-
- uses: oven-sh/setup-bun@v2
17+
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
1818
with:
1919
bun-version: latest
2020

@@ -31,11 +31,11 @@ jobs:
3131
runs-on: ubuntu-latest
3232

3333
steps:
34-
- uses: actions/checkout@v6
34+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3535
with:
3636
fetch-depth: 0
3737

38-
- uses: oven-sh/setup-bun@v2
38+
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
3939
with:
4040
bun-version: latest
4141

‎.github/workflows/claude.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,13 +26,13 @@ jobs:
2626
actions: read # Required for Claude to read CI results on PRs
2727
steps:
2828
- name: Checkout repository
29-
uses: actions/checkout@v4
29+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
3030
with:
3131
fetch-depth: 1
3232

3333
- name: Run Claude Code
3434
id: claude
35-
uses: anthropics/claude-code-action@v1
35+
uses: anthropics/claude-code-action@ef50f123a3a9be95b60040d042717517407c7256 # v1.0.110
3636
with:
3737
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
3838

‎.github/workflows/deploy-managed-agents.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -52,13 +52,13 @@ jobs:
5252
name: Deploy managed agents/skills
5353
runs-on: ubuntu-latest
5454
steps:
55-
- uses: actions/checkout@v6
55+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5656

57-
- uses: oven-sh/setup-bun@v2
57+
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
5858
with:
5959
bun-version: ${{ env.BUN_VERSION }}
6060

61-
- uses: actions/cache@v5
61+
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
6262
with:
6363
path: ~/.bun/install/cache
6464
key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}

‎.github/workflows/deploy-workers.yml‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -39,10 +39,10 @@ jobs:
3939
discovery: ${{ steps.filter.outputs.discovery }}
4040
webhooks: ${{ steps.filter.outputs.webhooks }}
4141
steps:
42-
- uses: actions/checkout@v6
42+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4343
with:
4444
fetch-depth: 2
45-
- uses: dorny/paths-filter@v4
45+
- uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
4646
id: filter
4747
with:
4848
filters: |
@@ -82,11 +82,11 @@ jobs:
8282
# On push: fan out to prod + staging. On manual dispatch: just the chosen env.
8383
environment: ${{ github.event_name == 'workflow_dispatch' && fromJSON(format('["{0}"]', inputs.environment)) || fromJSON('["production", "staging"]') }}
8484
steps:
85-
- uses: actions/checkout@v6
86-
- uses: oven-sh/setup-bun@v2
85+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
86+
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
8787
with:
8888
bun-version: ${{ env.BUN_VERSION }}
89-
- uses: actions/cache@v5
89+
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
9090
with:
9191
path: ~/.bun/install/cache
9292
key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
@@ -128,11 +128,11 @@ jobs:
128128
matrix:
129129
environment: ${{ github.event_name == 'workflow_dispatch' && fromJSON(format('["{0}"]', inputs.environment)) || fromJSON('["production", "staging"]') }}
130130
steps:
131-
- uses: actions/checkout@v6
132-
- uses: oven-sh/setup-bun@v2
131+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
132+
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
133133
with:
134134
bun-version: ${{ env.BUN_VERSION }}
135-
- uses: actions/cache@v5
135+
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
136136
with:
137137
path: ~/.bun/install/cache
138138
key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock', 'workers/mcp/bun.lock') }}
@@ -162,11 +162,11 @@ jobs:
162162
matrix:
163163
environment: ${{ github.event_name == 'workflow_dispatch' && fromJSON(format('["{0}"]', inputs.environment)) || fromJSON('["production", "staging"]') }}
164164
steps:
165-
- uses: actions/checkout@v6
166-
- uses: oven-sh/setup-bun@v2
165+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
166+
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
167167
with:
168168
bun-version: ${{ env.BUN_VERSION }}
169-
- uses: actions/cache@v5
169+
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
170170
with:
171171
path: ~/.bun/install/cache
172172
key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock', 'workers/discovery/bun.lock') }}
@@ -193,11 +193,11 @@ jobs:
193193
)
194194
runs-on: ubuntu-latest
195195
steps:
196-
- uses: actions/checkout@v6
197-
- uses: oven-sh/setup-bun@v2
196+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
197+
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
198198
with:
199199
bun-version: ${{ env.BUN_VERSION }}
200-
- uses: actions/cache@v5
200+
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
201201
with:
202202
path: ~/.bun/install/cache
203203
key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock', 'workers/webhooks/bun.lock') }}
@@ -253,7 +253,7 @@ jobs:
253253
)
254254
runs-on: ubuntu-latest
255255
steps:
256-
- uses: actions/checkout@v6
256+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
257257
- name: Install mcp-publisher
258258
run: |
259259
set -euo pipefail

‎.github/workflows/publish-api-types.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,9 @@ jobs:
2525
runs-on: ubuntu-latest
2626

2727
steps:
28-
- uses: actions/checkout@v6
28+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2929

30-
- uses: oven-sh/setup-bun@v2
30+
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
3131
with:
3232
bun-version: latest
3333

‎.github/workflows/publish-core.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,9 @@ jobs:
2525
runs-on: ubuntu-latest
2626

2727
steps:
28-
- uses: actions/checkout@v6
28+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2929

30-
- uses: oven-sh/setup-bun@v2
30+
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
3131
with:
3232
bun-version: latest
3333

‎.github/workflows/sync-staging-db.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,11 +34,11 @@ jobs:
3434
echo "Refusing to run: 'confirm' input must be exactly 'yes'."
3535
exit 1
3636
fi
37-
- uses: actions/checkout@v6
38-
- uses: oven-sh/setup-bun@v2
37+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
38+
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
3939
with:
4040
bun-version: ${{ env.BUN_VERSION }}
41-
- uses: actions/cache@v5
41+
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
4242
with:
4343
path: ~/.bun/install/cache
4444
key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}

0 commit comments

Comments
 (0)