fix(ci): pin bfra-me/.github renovate.yaml reusable workflow to SHA - #950
Open
fro-bot wants to merge 1 commit into
Open
fix(ci): pin bfra-me/.github renovate.yaml reusable workflow to SHA#950fro-bot wants to merge 1 commit into
fro-bot wants to merge 1 commit into
Conversation
The reusable workflow reference at .github/workflows/renovate.yaml:34 used a floating @v4 tag instead of a full commit SHA, inconsistent with every other bfra-me org repo (all pin this exact call to a SHA + version comment) and with this repo's own update-repo-settings.yaml, which already pins the sibling workflow from the same bfra-me/.github release to 5310cfc4 # v4.26.0. Pinned to the same commit (5310cfc4af25a89c95e1ac64bf7e9e5503bde9a1), which is the current v4.26.0 tag target, verified via: gh api repos/bfra-me/.github/git/refs/tags/v4.26.0 --jq '.object.sha' Flagged repeatedly by bfra-me/.github's daily Fro Bot org-wide scan.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Pins the reusable workflow reference at
.github/workflows/renovate.yaml:34from the floating@v4tag to a full commit SHA with a version comment:bfra-me/.github/.github/workflows/renovate.yaml@5310cfc4af25a89c95e1ac64bf7e9e5503bde9a1 # v4.26.0.Why
This was the only floating-tag
uses:reference found across a scan of all 6 non-archivedbfra-meorg repos' workflows. It's inconsistent with:bfra-merepo, which pins the same reusable workflow to a full SHA..github/workflows/update-repo-settings.yaml, which already pins the sibling reusable workflow from the samebfra-me/.githubrelease to5310cfc4af25a89c95e1ac64bf7e9e5503bde9a1 # v4.26.0.Floating tags on reusable workflow calls are a supply-chain risk (a tag can be moved/deleted) and this org's stated convention (
bfra-me/.githubAGENTS.md) is to always pin actions/workflows to a commit SHA with a version comment.Verification
5310cfc4af25a89c95e1ac64bf7e9e5503bde9a1is the currentv4.26.0tag target:update-repo-settings.yaml:16.Opened by the bfra-me/.github daily Fro Bot org-wide scan (category 7d: Action & Workflow Integrity / SHA pinning), flagged in previous daily reports (e.g. bfra-me/.github#2344).