From 0ceb10bc013f32d31f98e17f6213c4f545d345f3 Mon Sep 17 00:00:00 2001 From: Sentinel Security Research Date: Sun, 2 Aug 2026 01:01:54 -0600 Subject: [PATCH] Sentinel: harden CI/CD (29 best practices) Generated by Sentinel security research. Evidence in the PR description. --- .github/workflows/claude.yml | 4 ++-- .github/workflows/conformance.yml | 8 ++++---- .github/workflows/deploy-docs.yml | 10 +++++----- .github/workflows/examples.yml | 4 ++-- .github/workflows/main.yml | 16 ++++++++-------- .github/workflows/publish.yml | 4 ++-- .github/workflows/release.yml | 8 ++++---- .github/workflows/update-spec-types.yml | 4 ++-- 8 files changed, 29 insertions(+), 29 deletions(-) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 5e48e2c5ea..abc340705d 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -27,13 +27,13 @@ jobs: actions: read steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: fetch-depth: 1 - name: Run Claude Code id: claude - uses: anthropics/claude-code-action@v1 + uses: anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510b with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} use_commit_signing: true diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml index bb2dbef504..8cc89261a4 100644 --- a/.github/workflows/conformance.yml +++ b/.github/workflows/conformance.yml @@ -17,12 +17,12 @@ jobs: client-conformance: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - name: Install pnpm uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0 with: run_install: false - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 with: node-version: 24 cache: pnpm @@ -35,12 +35,12 @@ jobs: server-conformance: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - name: Install pnpm uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0 with: run_install: false - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 with: node-version: 24 cache: pnpm diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml index 68ed84f8e6..447d8348f7 100644 --- a/.github/workflows/deploy-docs.yml +++ b/.github/workflows/deploy-docs.yml @@ -25,13 +25,13 @@ jobs: url: ${{ steps.deployment.outputs.page_url }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - name: Install pnpm uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0 with: run_install: false - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 with: node-version: 24 cache: pnpm @@ -44,13 +44,13 @@ jobs: run: bash scripts/build-docs-site.sh tmp/docs-combined - name: Configure Pages - uses: actions/configure-pages@v6 + uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d - name: Upload Pages artifact - uses: actions/upload-pages-artifact@v4 + uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b with: path: tmp/docs-combined - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v5 + uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 diff --git a/.github/workflows/examples.yml b/.github/workflows/examples.yml index e00c0c289c..813361640f 100644 --- a/.github/workflows/examples.yml +++ b/.github/workflows/examples.yml @@ -24,14 +24,14 @@ jobs: name: examples (build + e2e) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - name: Install pnpm uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0 with: run_install: false - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 with: node-version: 24 cache: pnpm diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 9aba480eae..7069dc0d28 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -15,14 +15,14 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - name: Install pnpm uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0 id: pnpm-install with: run_install: false - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 with: node-version: 24 cache: pnpm @@ -41,14 +41,14 @@ jobs: node-version: [20, 22, 24] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - name: Install pnpm uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0 id: pnpm-install with: run_install: false - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 with: node-version: ${{ matrix.node-version }} cache: pnpm @@ -67,14 +67,14 @@ jobs: node-version: [20, 22, 24] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - name: Install pnpm uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0 id: pnpm-install with: run_install: false - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 with: node-version: ${{ matrix.node-version }} cache: pnpm @@ -95,12 +95,12 @@ jobs: - runtime: deno version: v2.x steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - name: Install pnpm uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0 with: run_install: false - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 with: node-version: 24 cache: pnpm diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index d8db820e13..5eba94e928 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -16,7 +16,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - name: Install pnpm uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0 @@ -24,7 +24,7 @@ jobs: run_install: false - name: Setup Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 with: node-version: 24 cache: pnpm diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3682c55480..2f202e3ec7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -17,7 +17,7 @@ jobs: outputs: hasChangesets: ${{ steps.changesets.outputs.hasChangesets }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - name: Install pnpm uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0 @@ -25,7 +25,7 @@ jobs: run_install: false - name: Setup Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 with: node-version: 24 cache: pnpm @@ -50,7 +50,7 @@ jobs: contents: write id-token: write steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - name: Install pnpm uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0 @@ -58,7 +58,7 @@ jobs: run_install: false - name: Setup Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 with: node-version: 24 cache: pnpm diff --git a/.github/workflows/update-spec-types.yml b/.github/workflows/update-spec-types.yml index c62aca8907..234129da56 100644 --- a/.github/workflows/update-spec-types.yml +++ b/.github/workflows/update-spec-types.yml @@ -26,7 +26,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - name: Install pnpm uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0 @@ -35,7 +35,7 @@ jobs: run_install: false - name: Setup Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 with: node-version: 24 cache: pnpm