feat(ci): use sha instead of tag on steps#487
Conversation
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #487 +/- ##
=======================================
Coverage 80.30% 80.30%
=======================================
Files 22 22
Lines 3697 3697
=======================================
Hits 2969 2969
Misses 587 587
Partials 141 141 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull Request Overview
This pull request updates GitHub Actions workflow files to use explicit commit SHAs instead of floating version tags, improving security and reliability by pinning actions to specific commits. This follows security best practices by preventing unexpected updates that could introduce breaking changes or vulnerabilities.
- Replace floating version tags (e.g.,
v4,v5) with commit SHAs and version comments - Update all GitHub Actions across multiple workflow files
- Add version comments for clarity and maintenance
Reviewed Changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/documentation.yml | Pin checkout, setup-go, upload-release-action, and repository-dispatch actions to specific SHAs |
| .github/workflows/dockerhub.yml | Pin checkout and dockerhub-description actions to specific SHAs |
| .github/workflows/codeql-analysis.yml | Pin checkout, setup-go, and CodeQL actions to specific SHAs |
| .github/workflows/codecov.yml | Pin checkout, setup-go, tailscale, and codecov actions to specific SHAs |
| .github/workflows/build.yml | Pin multiple Docker-related actions, cosign-installer, and repository-dispatch actions to specific SHAs |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
This pull request updates several GitHub Actions in workflow files to use explicit commit SHAs for each action, rather than floating version tags. This change improves security and reliability by ensuring the workflows always use the intended action versions, preventing unexpected updates or breaking changes.
closes #485