Skip to content

ci: Pin GitHub Actions to commit SHAs#2507

Merged
chmouel merged 1 commit intotektoncd:mainfrom
vdemeester:main-brave-tide
Feb 25, 2026
Merged

ci: Pin GitHub Actions to commit SHAs#2507
chmouel merged 1 commit intotektoncd:mainfrom
vdemeester:main-brave-tide

Conversation

@vdemeester
Copy link
Copy Markdown
Member

@vdemeester vdemeester commented Feb 25, 2026 •
edited
Loading

📝 Description of the Change

Pin all GitHub Actions in workflows to their commit SHAs instead of mutable version tags, keeping the version as an inline comment for readability (e.g. actions/checkout@de0fac2...# v6).

This covers both .github/workflows/container.yaml and .github/workflows/e2e.yaml.

🔗 Linked Jira

🔗 Linked GitHub Issue

📊 Type of Change

  • 🐛 Bug fix (fix:)
  • ✨ New feature (feat:)
  • 💥 Breaking change (feat!:, fix!:)
  • 📖 Documentation update (docs:)
  • ⚙️ Chore (chore:)
  • 🔄 Refactor (refactor:)
  • 🚀 Enhancement (enhance:)
  • 📦 Dependency update (deps:)

🧪 Testing Strategy

  • Unit tests
  • Integration tests
  • End-to-end tests
  • Manual testing
  • Not Applicable

🤖 AI Assistance

  • I have not used any AI assistance for this PR.
  • I have used AI assistance for this PR.

✅ Submitter Checklist

  • 📝 My commit messages are clear, informative, and follow the project's How to write a git commit message guide.
  • ✨ I have ensured my commit message prefix (e.g., fix:, feat:) matches the "Type of Change" I selected above.
  • ♽ I have run make test and make lint locally to check for and fix any issues.
  • 📖 I have added or updated documentation for any user-facing changes.
  • 🧪 I have added sufficient unit tests for my code changes.
  • 🔬 I have added end-to-end tests where feasible.
  • 🚦 I have addressed any CI test flakiness or provided a clear reason to bypass it.

@vdemeester
ci: Pin GitHub Actions to commit SHAs
5dc3b2e 
- Improve supply chain security by using immutable refs
- Ease transfer of workflows to tektoncd organization

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
@gemini-code-assist
Copy link
Copy Markdown

gemini-code-assist bot commented Feb 25, 2026

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

@pipelines-as-code
Copy link
Copy Markdown

pipelines-as-code bot commented Feb 25, 2026

🔍 PR Lint Feedback

Note: This automated check helps ensure your PR follows our contribution guidelines.

⚠️ Items that need attention:

🎫 Jira reference

Add a Jira reference in the description using one of the following formats:

  • https://issues.redhat.com/browse/SRVKP-<number>

If no SRVKP ticket exists yet, link a GitHub issue instead (e.g., Fixes #123).
Minor housekeeping PRs without Jira coverage can skip this after confirming with reviewers.

🤖 AI attribution

The following commits lack an explicit AI attribution footer:

  • 5dc3b2e ci: Pin GitHub Actions to commit SHAs

If no AI assistance was used for a commit, you can ignore this warning.
Otherwise add an Assisted-by: or Co-authored-by: footer referencing the AI used.

ℹ️ Next Steps

  • Review and address the items above
  • Push new commits to update this PR
  • This comment will be automatically updated when issues are resolved
🔧 Admin Tools (click to expand)

Automated Issue/Ticket Creation:

  • /issue-create - Generate a GitHub issue from this PR content using AI
  • /jira-create - Create a SRVKP Jira ticket from this PR content using AI

⚠️ Important: Always review and edit generated content before finalizing tickets/issues.
The AI-generated content should be used as a starting point and may need adjustments.

These commands are available to maintainers and will post the generated content as PR comments for review.

🤖 This feedback was generated automatically by the PR CI system

@pipelines-as-code pipelines-as-code bot added ci github_actions Pull requests that update GitHub Actions code security labels Feb 25, 2026
@chmouel chmouel merged commit f97499b into tektoncd:main Feb 25, 2026
8 of 9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

ci github_actions Pull requests that update GitHub Actions code security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@vdemeester @chmouel