Pin GitHub Actions to immutable SHAs

Author: Tsvetan Stoychev

.github/workflows/ci.yml

@@ -18,10 +18,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.2'
           tools: composer:v2
@@ -49,10 +49,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup PHP and WP-CLI
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.2'
           tools: wp-cli:2.12.0
@@ -71,10 +71,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version-file: .nvmrc
           cache: npm
@@ -99,10 +99,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: ${{ matrix.php }}
           tools: composer:v2
@@ -152,10 +152,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: ${{ matrix.php }}
           tools: composer:v2
@@ -195,10 +195,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup release PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '7.4'
           tools: composer:v2
@@ -216,7 +216,7 @@ jobs:
         run: sh tools/smoke-test-release.sh release/basicrum.zip
 
       - name: Upload release artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: basicrum-release
           path: |

.github/workflows/prerelease.yml

@@ -14,10 +14,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup release PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '7.4'
           tools: composer:v2
@@ -35,7 +35,7 @@ jobs:
         run: sh tools/smoke-test-release.sh release/basicrum.zip
 
       - name: Upload release assets
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           files: |
             release/basicrum.zip

.github/workflows/release.yml

@@ -14,10 +14,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup release PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '7.4'
           tools: composer:v2
@@ -35,7 +35,7 @@ jobs:
         run: sh tools/smoke-test-release.sh release/basicrum.zip
 
       - name: Upload release assets
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           files: |
             release/basicrum.zip

AGENTS.md

@@ -30,6 +30,9 @@ namespace, PSR-4 Composer autoloading, PHP 7.4+, and WordPress 6.0+.
   hard-coded script handles.
 - Boomerang lives in `assets/js/boomr/`; standard and consent loaders live in
   `assets/js/loaders/`.
+- Pin third-party GitHub Actions to full 40-character commit SHAs. Keep the
+  reviewed release tag in the adjacent comment and update pins through reviewed
+  Dependabot pull requests.
 
 ## Checks
 

README.md

@@ -135,3 +135,14 @@ security advisories. CI runs all three checks on every push and pull request.
 Dependabot checks npm, Composer dependencies, and GitHub Actions weekly. CI
 workflows use a read-only `GITHUB_TOKEN`; release and pre-release workflows
 receive only the `contents: write` permission required to attach release assets.
+
+### GitHub Actions supply-chain policy
+
+Every third-party GitHub Action is pinned to a full 40-character commit SHA.
+The comment beside each pin identifies the reviewed upstream release tag.
+Dependabot opens weekly GitHub Actions update pull requests. Before merging one,
+verify that the proposed SHA belongs to the expected upstream release, review the
+upstream changes and permissions, keep the SHA and release-tag comment in sync,
+and require CI to pass. Exercise an update used only by a release workflow with
+a prerelease before using it for a production release. Apply the same review when
+making a manual action update; never replace a pin with a mutable tag.

checklist.md

@@ -119,8 +119,8 @@ Acceptance criteria:
 - [x] Set explicit minimal `GITHUB_TOKEN` permissions in every workflow.
 - [x] Give release workflows only the additional permissions required to upload
   assets.
-- [ ] Pin third-party GitHub Actions to immutable commit SHAs.
-- [ ] Document how pinned actions are reviewed and updated.
+- [x] Pin third-party GitHub Actions to immutable commit SHAs.
+- [x] Document how pinned actions are reviewed and updated.
 
 Acceptance criteria: