Pin GitHub Actions to commit SHAs#919
Conversation
jportner-ant
force-pushed
the
devsec/pin-actions
branch
from
fb22ea1 to
0359cec
Compare
The with: block had two claude_args keys (lines 48 and 57), which is invalid YAML — both ruamel and GitHub Actions reject it. The workflow has been failing to parse since #556 (2026-02-07). Merge both intended values (--model and --allowed-tools) into a single block scalar.
Note on
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — mechanical SHA pins plus a fix for the duplicate claude_args key that was breaking the workflow parse.
Extended reasoning...
Overview
This PR touches four GitHub Actions workflow files. Two of the changes (pypi-quota-check.yml, slack-issue-notification.yml) are comment-only — the slackapi/slack-github-action reference was already pinned to SHA 91efab1…, and only the trailing annotation changed from # 2.1.1 to # v2.1.1 (sha-pinned). In test.yml, codecov/codecov-action is pinned from the mutable v4 tag to commit b9fd7d16… (v4.6.0). In claude.yml, two duplicate claude_args keys are merged into a single block scalar so the file is valid YAML again; the merged value is exactly the union of the two prior values (--model + --allowed-tools), with no new flags introduced.
Security risks
None identified. This is a security-hardening change: replacing a mutable tag with an immutable SHA reduces supply-chain risk. No new third-party actions are introduced, no permissions blocks are widened, and no secrets handling is altered. The claude.yml fix does not change the allowed-tools surface — it just makes the previously-intended config actually load.
Level of scrutiny
Low. Two files have zero functional diff. The codecov pin is a tool-generated, widely-used pinning pattern with fail_ci_if_error: false, so even a bad pin would only drop coverage uploads rather than break CI. The claude.yml change is restoring a workflow that has been failing to parse for months; the author's timeline note explains the rationale clearly and the merged block scalar is the obvious correct resolution.
Other factors
No CODEOWNERS file in the repo. No bugs flagged by the bug-hunting system. No outstanding reviewer requests. The change set is small, self-contained, and follows the established pattern already present in the slack workflow files.
2 participants
Pin third-party GitHub Actions references to immutable commit SHAs.