Skip to content

Compliance: unpinned-actions-dependency-audit.yml #106

Closed
Closed
Compliance: unpinned-actions-dependency-audit.yml#106
Labels
compliance-auditAutomated compliance audit finding

Description

@don-petry
don-petry
opened on Apr 9, 2026

Compliance Finding

Category: action-pinning
Severity: error
Check: unpinned-actions-dependency-audit.yml

Detail

Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: - uses: dtolnay/rust-toolchain@stable

Standard Reference

standards/ci-standards.md#action-pinning-policy

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

This issue was automatically created by the weekly compliance audit.

Activity

  1. don-petry
    added
    compliance-auditAutomated compliance audit finding
    on Apr 9, 2026

  2. don-petry commented on Apr 9, 2026

    @don-petry
    don-petry
    on Apr 9, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-04-09)

    This finding is still open.

    Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: - uses: dtolnay/rust-toolchain@stable

    Standard: standards/ci-standards.md#action-pinning-policy

  3. don-petry
    added
    claude
    on Apr 9, 2026

  4. don-petry commented on Apr 9, 2026

    @don-petry
    don-petry
    on Apr 9, 2026
    ContributorAuthor

    Claude encountered an error —— View job

    Fixing Action Pinning Compliance Issue

    • Read AGENTS.md and ci-standards.md
    • Locate dependency-audit.yml workflow file
    • Look up SHA for dtolnay/rust-toolchain@stable
    • Pin the action to SHA
    • Commit and push changes
    • Create a PR

  5. don-petry commented on Apr 10, 2026

    @don-petry
    don-petry
    on Apr 10, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-04-10)

    This finding is still open.

    Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: - uses: dtolnay/rust-toolchain@stable

    Standard: standards/ci-standards.md#action-pinning-policy

  6. don-petry
    added
    claude
    and removed
    claude
    on Apr 14, 2026

  7. don-petry commented on Apr 14, 2026

    @don-petry
    don-petry
    on Apr 14, 2026
    ContributorAuthor

    Claude encountered an error —— View job

    I'll analyze this and get back to you.

  8. don-petry commented on Apr 17, 2026

    @don-petry
    don-petry
    on Apr 17, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-04-17)

    This finding is still open.

    Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: - uses: dtolnay/rust-toolchain@stable

    Standard: standards/ci-standards.md#action-pinning-policy

  9. don-petry commented on Apr 21, 2026

    @don-petry
    don-petry
    on Apr 21, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-04-21)

    This finding is still open.

    Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: - uses: dtolnay/rust-toolchain@stable

    Standard: standards/ci-standards.md#action-pinning-policy

  10. don-petry commented on Apr 24, 2026

    @don-petry
    don-petry
    on Apr 24, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-04-24)

    This finding is still open.

    Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: - uses: dtolnay/rust-toolchain@stable

    Standard: standards/ci-standards.md#action-pinning-policy

  11. don-petry commented on May 1, 2026

    @don-petry
    don-petry
    on May 1, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-05-01)

    This finding is still open.

    Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: - uses: dtolnay/rust-toolchain@stable

    Standard: standards/ci-standards.md#action-pinning-policy

  12. don-petry commented on May 8, 2026

    @don-petry
    don-petry
    on May 8, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-05-08)

    This finding is still open.

    Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: - uses: dtolnay/rust-toolchain@stable

    Standard: standards/ci-standards.md#action-pinning-policy

  13. don-petry
    added
    claude
    and removed
    claude
    on May 8, 2026

  14. don-petry commented on May 8, 2026

    @don-petry
    don-petry
    on May 8, 2026
    ContributorAuthor

    Claude finished @don-petry's task in 2m 30s —— View job • claude/issue-106-20260508-1732 • [Create PR ➔](https://github.com/petry-projects/.github/compare/main...claude/issue-106-20260508-1732?quick_pull=1&title=Issue%20%23106%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%23106%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

    Fixing Action Pinning Compliance Issue

    • Read AGENTS.md and ci-standards.md
    • Check standards/workflows/dependency-audit.yml template
    • Locate current dependency-audit.yml workflow file
    • Replace standalone workflow with thin caller stub (per org standard template)
    • Commit and push changes
    • Create a PR
    • Self-review PR — change is a verbatim copy of the standard template, no issues found
    • CI green (Lint, ShellCheck, AgentShield, dependency-audit all passing)
    • Tagged @petry-projects/org-leads for review

    What was done: The standalone dependency-audit.yml (which contained the unpinned dtolnay/rust-toolchain@stable action) was replaced with the org-standard thin caller stub copied verbatim from standards/workflows/dependency-audit.yml. The caller delegates all logic to dependency-audit-reusable.yml, which uses rustup directly — eliminating the third-party action and the pinning violation that caused this compliance finding.

    PR: #217

  15. don-petry commented on May 11, 2026

    @don-petry
    don-petry
    on May 11, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-05-11)

    This finding is still open.

    Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: - uses: dtolnay/rust-toolchain@stable

    Standard: standards/ci-standards.md#action-pinning-policy

  16. don-petry commented on May 12, 2026

    @don-petry
    don-petry
    on May 12, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-05-12)

    This finding is still open.

    Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: - uses: dtolnay/rust-toolchain@stable

    Standard: standards/ci-standards.md#action-pinning-policy

  17. don-petry commented on May 12, 2026

    @don-petry
    don-petry
    on May 12, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-05-12)

    This finding is still open.

    Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: - uses: dtolnay/rust-toolchain@stable

    Standard: standards/ci-standards.md#action-pinning-policy

  18. don-petry commented on May 12, 2026

    @don-petry
    don-petry
    on May 12, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-05-12)

    This finding is still open.

    Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: - uses: dtolnay/rust-toolchain@stable

    Standard: standards/ci-standards.md#action-pinning-policy

  19. don-petry commented on May 12, 2026

    @don-petry
    don-petry
    on May 12, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-05-12)

    This finding is still open.

    Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: - uses: dtolnay/rust-toolchain@stable

    Standard: standards/ci-standards.md#action-pinning-policy

  20. don-petry commented on May 12, 2026

    @don-petry
    don-petry
    on May 12, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-05-12)

    This finding is still open.

    Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: - uses: dtolnay/rust-toolchain@stable

    Standard: standards/ci-standards.md#action-pinning-policy

  21. don-petry commented on May 13, 2026

    @don-petry
    don-petry
    on May 13, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-05-13)

    This finding is still open.

    Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: - uses: dtolnay/rust-toolchain@stable

    Standard: standards/ci-standards.md#action-pinning-policy

  22. don-petry
    added 2 commits that reference this issue on May 13, 2026

    fix: replace standalone dependency-audit.yml with org standard thin c…

    f2da3f4

    fix: replace standalone dependency-audit.yml with org standard thin c…

    7dd04ca

  23. don-petry commented on May 15, 2026

    @don-petry
    don-petry
    on May 15, 2026
    ContributorAuthor

    Resolved! This check is now passing as of 2026-05-15. Closing automatically.

  24. don-petry
    closed this as completedon May 15, 2026
  25. don-petry
    added a commit that references this issue on Jun 8, 2026

    fix: replace standalone dependency-audit.yml with org standard thin c…

    394fb13
  26. don-petry
    added 2 commits that reference this issue on Jun 26, 2026

    fix: replace standalone dependency-audit.yml with org standard thin c…

    5966760

    fix: replace standalone dependency-audit.yml with org standard thin c…

    84abb80
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    compliance-auditAutomated compliance audit finding

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions