CI-11: Full-SHA action pinning, least privilege, and hosted-only qualification of CI-control changes

[Chris0Jeky]

Wave: Smart CI Fabric (ADR-0066 §Decision 12). Tracker: CI-00 #2324. Lane: supply chain, R4.

Context (live 2026-08-30)

External uses: inventory across .github/workflows/: actions/checkout@v7 (41), actions/upload-artifact@v7 (38), actions/setup-node@v7 (22), actions/setup-dotnet@v6 (22), actions/cache@v6 (5), actions/download-artifact@v8 (4), actions/setup-python@v7 (2), docker/setup-buildx-action@v4, docker/metadata-action@v6, docker/login-action@v4, docker/build-push-action@v7, actions/configure-pages@v6, actions/upload-pages-artifact@v5, actions/deploy-pages@v5, actions/dependency-review-action@v5 — only gitleaks/gitleaks-action is SHA-pinned. Repository setting sha_pinning_required: false; default workflow token permissions already read; Dependabot groups Actions updates weekly. #1819 (CodeQL default setup disabled 2026-08-19 after hung Analyze checks) is the other scanning residual.

Scope

• scripts/ci/smart-ci/action-pins.mjs: inventory every external action with its pin status; emits JSON + Markdown; a node --test guard fails when an unpinned external reference appears.
• Pin every external action to a full commit SHA with a # vX.Y.Z comment; keep Dependabot's grouped Actions updates working with SHA pins.
• Least privilege: audit every job with elevated permissions; persist-credentials: false on every checkout that does not push; no pull_request_target workflow may check out or execute head code (the Smart CI planner reads the file list only — contract test).
• CI-control changes (.github/**, ci/**, scripts/ci/**, package bootstrap, release scripts) are R4/T2: hosted-only qualification, never self-hosted (policy fixture).
• Maintainer setting (human): flip sha_pinning_required on after the migration; recorded in OUTSTANDING_TASKS.md §J.
• Decide #1819 (re-enable CodeQL under the new hosted-control lane, or record why not).

Acceptance

• Every external action pinned to a full SHA with a version comment; the guard test is green and runs in the hosted control job.
• pull_request_target contract test proves no head checkout/execution.
• R4 fixture proves hosted-only resolution for control paths.
• Setting flip prepared as an exact command for the maintainer.

Dependencies / release

Depends on CI-02. Milestone v0.3; CI-13 prerequisite.

[Chris0Jeky]

Inventory 2026-08-30 (node scripts/ci/smart-ci/action-pins.mjs, PR #2342): 152 external uses: references across 34 workflow files, 1 pinned to a full SHA (gitleaks), 151 unpinned, 16 distinct actions (actions/checkout@v7 ×44, actions/upload-artifact@v7 ×38, actions/setup-node@v7 ×22, actions/setup-dotnet@v6 ×22, actions/cache@v6 ×5, actions/download-artifact@v8 ×4, actions/setup-python@v7 ×2, docker/* ×4, pages ×3, actions/dependency-review-action@v5 ×1). Repository setting sha_pinning_required: false; default workflow token already read. The inventory runs report-only in Smart CI / Planner Self-Test; --check becomes the guard once the migration lands. Note for the private cutover: actions/dependency-review-action and CodeQL need GitHub Advanced Security on a private repository (not in a personal Pro plan) — ci-extended's dependency-review job must be removed or gated, and Semgrep + the in-repo dependency signals stay the gates (recorded in RECONCILIATION.md #12 and on the CI-13 checklist).

[Chris0Jeky]

SC-10 progress (coordinator, 2026-09-06). PR #2502 (CI-11 slice 1) merged as e0a824187 at head 7a0b7793a: branch updated to main, fresh-context re-review against the moved base (FIX-FIRST → fixed: the Stryker workflow-contract text now carries the pinned upload-artifact SHA, the guard's advisory status is stated honestly, SMART_CI.md names --check), hosted run green. All 152 external actions across 34 workflows are pinned. SC-5 is now unblocked: flipping sha_pinning_required is the maintainer's; the command is in the PR body. LOWs recorded on the PR: the guard scans only top-level workflow files and single-line uses: shapes; # v7 is accepted where actionlint wants # vN.N.N.

[Chris0Jeky]

SC-5 correction (coordinator, 2026-09-06). The command in PR #2502's body targets actions/permissions/workflow, which has no sha_pinning_required field (the PUT is accepted and the field silently ignored; verified: that endpoint returns only default_workflow_permissions and can_approve_pull_request_reviews). The setting lives on the Actions permissions root, currently {"enabled":true,"allowed_actions":"all","sha_pinning_required":false}. Maintainer command:

gh api -X PUT repos/Chris0Jeky/Taskdeck/actions/permissions -F enabled=true -f allowed_actions=all -F sha_pinning_required=true
gh api repos/Chris0Jeky/Taskdeck/actions/permissions --jq .sha_pinning_required

UI equivalent: Settings → Actions → General → "Require actions to be pinned to a full-length commit SHA". Agents do not change this setting.

[Chris0Jeky]

SC-5 executed and verified (2026-09-06)

The maintainer ran the corrected command; the setting is on.

$ gh api repos/Chris0Jeky/Taskdeck/actions/permissions
{"enabled":true,"allowed_actions":"all","sha_pinning_required":true}

The PUT prints nothing on success, which is why it looked like it had not worked — the read-back is the proof. This closes the Maintainer setting (human) line in this issue's Scope and ticks §J SC-5 in OUTSTANDING_TASKS.md.

No workflow is broken by the flip: #2502 (e0a824187) had already pinned every external uses: in .github/workflows/ to a full SHA, so the setting is now enforcing an inventory that already complies. The action-pins guard keeps it that way.

What still keeps this issue open

None of these are maintainer actions:

• pull_request_target contract test proving no head checkout or head-code execution.
• R4 fixture proving hosted-only resolution for control paths.
• The #1819 decision — re-enable CodeQL under the hosted-control lane, or record why not.

The first two Acceptance boxes (every external action pinned with the guard green in the hosted control job; the flip command prepared exactly) are done.