fix: repair 17 malformed SHA+tag action refs; add Frankenref guard (stack 8/8)#136
Merged
Conversation
Every affected ref had the form owner/action@<40-hex>v<semver> — a commit SHA and a version tag concatenated into one string GitHub cannot resolve, so each affected job (dependency review, SBOM, Scorecard, all Docker build/sign steps, Helm/K8s deploy) died before its first step. All 17 refs are now pinned as owner/action@<full-sha> # v<version>. Each SHA was verified against the upstream repo on 2026-07-22 by resolving the version tag through the GitHub API (annotated tags dereferenced to commit SHAs). Five embedded SHAs did not exist in their upstream repos at all (fabricated by the earlier automated edit): dependency-review-action, sbom-action, cosign-installer, attest-build-provenance, k8s-set-context — these were replaced with the real tag SHAs; the other 12 embedded SHAs matched their claimed tags and only needed the separator repaired. tools/check_action_refs.py + a Validate Action References job in contracts.yml now fail CI on the malformed pattern and warn on unpinned third-party actions, so the corruption cannot recur silently.
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
|
✅ PR size is within recommended limits |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Repair 17 malformed SHA+tag action references + recurrence guard
Stack position: main → #129 → #130 → #131 → #132 → #133 → #134 → #135 → this PR
Problem
Seventeen
uses:references across four workflows had a 40-hex commit SHA and a version tag concatenated into a single string GitHub cannot resolve:Every affected job — dependency review, SBOM generation, OpenSSF Scorecard, all Docker build/sign/attest steps, and Helm/K8s deploy — failed before its first step could run.
ci.ymldocker-build.ymlk8s-deploy.ymlsupply-chain.ymlFix
All 17 refs are now pinned in the standard form:
Every SHA was verified against the upstream repository (2026-07-22) by resolving the claimed version tag via the GitHub API, dereferencing annotated tags to commit SHAs.
Notable finding: 5 of the 17 embedded SHAs did not exist in their upstream repos at all — they were fabricated by whatever automated edit produced the corruption:
actions/dependency-review-action@v4.5.05aa4f05e3b139cfcanchore/sbom-action@v0.17.7fc46e51f b0e4…fc46e51f d3cb…(first 8 chars coincide)sigstore/cosign-installer@v3.7.022642962dc72c7d5actions/attest-build-provenance@v2.0.01c608d11619dbb2eazure/k8s-set-context@v4.0.037ded6a327bfb387The other 12 SHAs matched their claimed tags and only needed the separator repaired.
Recurrence guard
tools/check_action_refs.py+ a new Validate Action References job incontracts.yml:@<sha>v<version>Frankenref pattern anywhere in.github/workflows/Verification
ruff check/ruff format --checkpass on the guard script