Skip to content

Compliance: unpinned-actions-dependency-audit.yml #47

Closed
#76
Closed
Compliance: unpinned-actions-dependency-audit.yml#47
#76
Labels
compliance-auditAutomated compliance audit finding

Description

@don-petry
don-petry
opened on Apr 5, 2026

Compliance Finding

Category: action-pinning
Severity: error
Check: unpinned-actions-dependency-audit.yml

Detail

Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: - uses: dtolnay/rust-toolchain@stable

Standard Reference

standards/ci-standards.md#action-pinning-policy

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

This issue was automatically created by the weekly compliance audit.

Activity

  1. don-petry
    added
    compliance-auditAutomated compliance audit finding
    claude
    on Apr 5, 2026

  2. claude commented on Apr 5, 2026

    @claude
    claudeBot
    on Apr 5, 2026 – with Claude

    Claude Code is working…

    I'll analyze this and get back to you.

    View job run

  3. don-petry commented on Apr 6, 2026

    @don-petry
    don-petry
    on Apr 6, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-04-06)

    This finding is still open.

    Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: - uses: dtolnay/rust-toolchain@stable

    Standard: standards/ci-standards.md#action-pinning-policy

  4. don-petry commented on Apr 6, 2026

    @don-petry
    don-petry
    on Apr 6, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-04-06)

    This finding is still open.

    Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: - uses: dtolnay/rust-toolchain@stable

    Standard: standards/ci-standards.md#action-pinning-policy

  5. don-petry commented on Apr 6, 2026

    @don-petry
    don-petry
    on Apr 6, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-04-06)

    This finding is still open.

    Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: - uses: dtolnay/rust-toolchain@stable

    Standard: standards/ci-standards.md#action-pinning-policy

  6. don-petry commented on Apr 6, 2026

    @don-petry
    don-petry
    on Apr 6, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-04-06)

    This finding is still open.

    Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: - uses: dtolnay/rust-toolchain@stable

    Standard: standards/ci-standards.md#action-pinning-policy

  7. don-petry commented on Apr 6, 2026

    @don-petry
    don-petry
    on Apr 6, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-04-06)

    This finding is still open.

    Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: - uses: dtolnay/rust-toolchain@stable

    Standard: standards/ci-standards.md#action-pinning-policy

  8. don-petry
    added
    claude
    and removed
    claude
    on Apr 6, 2026

  9. don-petry commented on Apr 6, 2026

    @don-petry
    don-petry
    on Apr 6, 2026
    ContributorAuthor

    Claude finished @don-petry's task in 6m 19s —— View job

    Fix: Pin dtolnay/rust-toolchain to SHA

    • Read dependency-audit.yml to understand current state
    • Determine fix: pin dtolnay/rust-toolchain@stable to a commit SHA with explicit toolchain: stable input
    • Prepare the code change
    • Push change ⚠️ — blocked (see below)

    Prepared Change

    In .github/workflows/dependency-audit.yml, replace line 125:

    # Before
      - uses: dtolnay/rust-toolchain@stable

# After
      - uses: dtolnay/rust-toolchain@b3b07ba8eba0da7e97e29f82c60808e09c43a28e # stable
        with:
          toolchain: stable

    The toolchain: stable input is required when pinning to a SHA, because the action normally infers the Rust channel from the branch ref name — that inference breaks when using a SHA pin.

    Why This Can't Be Pushed Automatically

    The GitHub App token used by Claude Code lacks the workflows permission required to push changes to .github/workflows/ files. GitHub enforces this as a separate permission to prevent supply-chain attacks.

    Error: refusing to allow a GitHub App to create or update workflow without workflows permission

    How to Apply the Fix

    Option 1 — Apply manually:

    git checkout claude/issue-47-20260406-1853
# edit .github/workflows/dependency-audit.yml as shown above
git add .github/workflows/dependency-audit.yml
git commit -m "fix: pin dtolnay/rust-toolchain to SHA in dependency-audit.yml"
git push

    Then open a PR from claude/issue-47-20260406-1853 targeting main.

    Option 2 — Grant workflows permission to the GitHub App (in org settings → GitHub Apps → Claude Code → Permissions → Repository permissions → Workflows → Read & write), then re-trigger this issue.

    Option 3 — Apply the diff directly on main via the GitHub UI (edit the file in the browser, which uses your personal token that has workflows write access).

    Note on the SHA: The SHA b3b07ba8eba0da7e97e29f82c60808e09c43a28e was used from known pinned references. To verify the latest SHA from the stable branch, run: gh api repos/dtolnay/rust-toolchain/git/ref/heads/stable --jq '.object.sha'

  10. don-petry
    added
    claude
    and removed
    claude
    on Apr 7, 2026

  11. don-petry commented on Apr 7, 2026

    @don-petry
    don-petry
    on Apr 7, 2026
    ContributorAuthor

    Claude finished @don-petry's task in 1m 15s —— View job

    Fix: Pin dtolnay/rust-toolchain to SHA

    • Read dependency-audit.yml to understand current state
    • Get SHA for dtolnay/rust-toolchain stable branch (b3b07ba8eba0da7e97e29f82c60808e09c43a28e)
    • Apply the fix (pin to SHA with explicit toolchain: stable input)
    • Commit prepared locally
    • Push change ⚠️ — blocked (see below)

    Prepared Change

    In .github/workflows/dependency-audit.yml, line 125:

    # Before
      - uses: dtolnay/rust-toolchain@stable

# After
      - uses: dtolnay/rust-toolchain@b3b07ba8eba0da7e97e29f82c60808e09c43a28e # stable
        with:
          toolchain: stable

    The toolchain: stable input is required when pinning to a SHA because the action normally infers the Rust channel from the branch ref name — that inference breaks when using a SHA pin.

    Why This Can't Be Pushed Automatically

    The GitHub App token used by Claude Code lacks the workflows permission required to push changes to .github/workflows/ files. GitHub enforces this as a separate permission to prevent supply-chain attacks.

    Error: refusing to allow a GitHub App to create or update workflow without workflows permission

    How to Apply the Fix

    Option 1 — Apply manually:

    git fetch origin claude/issue-47-20260407-0239
git checkout claude/issue-47-20260407-0239
# The commit is already there — just push with a personal token or via the GitHub UI

    Option 2 — Apply the diff directly via GitHub UI:
    Navigate to .github/workflows/dependency-audit.yml on the main branch and edit it in the browser (uses your personal token which has workflows write access):

          - uses: dtolnay/rust-toolchain@b3b07ba8eba0da7e97e29f82c60808e09c43a28e # stable
        with:
          toolchain: stable

    Option 3 — Grant workflows permission to the GitHub App (org settings → GitHub Apps → Claude Code → Permissions → Repository permissions → Workflows → Read & write), then re-trigger this issue.

    Note on the SHA: b3b07ba8eba0da7e97e29f82c60808e09c43a28e is the HEAD of the dtolnay/rust-toolchain stable branch. To verify the latest SHA, run: gh api repos/dtolnay/rust-toolchain/git/ref/heads/stable --jq '.object.sha'

  12. don-petry
    added
    claude
    and removed
    claude
    on Apr 7, 2026

  13. don-petry commented on Apr 7, 2026

    @don-petry
    don-petry
    on Apr 7, 2026
    ContributorAuthor

    Claude finished @don-petry's task in 1m 14s —— View job • claude/issue-47-20260407-1732 • Create PR ➔

    Fix: Pin dtolnay/rust-toolchain to SHA

    • Read dependency-audit.yml to understand current state
    • Use verified SHA b3b07ba8eba0da7e97e29f82c60808e09c43a28e for dtolnay/rust-toolchain stable branch
    • Apply the fix (pin to SHA with explicit toolchain: stable input)
    • Commit and push changes
    • Create PR and tag code owner

    Change applied

    In .github/workflows/dependency-audit.yml, line 125:

    # Before
      - uses: dtolnay/rust-toolchain@stable

# After
      - uses: dtolnay/rust-toolchain@b3b07ba8eba0da7e97e29f82c60808e09c43a28e # stable
        with:
          toolchain: stable

    The toolchain: stable input is required when pinning to a SHA because the action normally infers the Rust channel from the branch ref name — that inference breaks when using a SHA pin.

  14. don-petry
    added a commit that references this issue on Apr 7, 2026

    fix: pin dtolnay/rust-toolchain to SHA in dependency-audit.yml

    2d7ae49
  15. don-petry
    added
    claude
    and removed
    claude
    on Apr 8, 2026

  16. don-petry commented on Apr 8, 2026

    @don-petry
    don-petry
    on Apr 8, 2026
    ContributorAuthor

    Claude finished @don-petry's task in 1m 49s —— View job • claude/issue-47-20260408-0149 • [Create PR ➔](https://github.com/petry-projects/markets/compare/main...claude/issue-47-20260408-0149?quick_pull=1&title=Issue%20%2347%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%2347%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

    Fix: Replace dtolnay/rust-toolchain with rustup

    • Analyze issue and plan tasks
    • Check org standards template for dependency-audit.yml — template found; it uses rustup toolchain install stable --profile minimal instead of the external action
    • Read current dependency-audit.yml
    • Apply fix — replaced file with org template verbatim
    • Commit and push
    • Create PR and tag code owner

    What changed

    The org standards template eliminates dtolnay/rust-toolchain@stable entirely, replacing it with:

    - name: Install Rust stable toolchain
  run: rustup toolchain install stable --profile minimal

    rustup is pre-installed on GitHub-hosted runners, so no external action (and no SHA to pin) is needed. The file was also synced with the latest template: pnpm audit support added, cargo-audit updated from 0.21.1 → 0.22.1, and checkout/setup-node/setup-go SHAs updated.

    View PR #76 | | claude/issue-47-20260408-0149

  17. don-petry
    added a commit that references this issue on Apr 8, 2026

    fix: replace dtolnay/rust-toolchain with rustup in dependency-audit.yml

    4102acd
  18. don-petry
    closed this as completedin #76on Apr 8, 2026
  19. don-petry
    added a commit that references this issue on Apr 8, 2026

    fix: replace dtolnay/rust-toolchain with rustup in dependency-audit.y…

    5bb65c2
  20. don-petry
    added a commit that references this issue on Jun 19, 2026

    fix: replace dtolnay/rust-toolchain with rustup in dependency-audit.y…

    facd12b
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    compliance-auditAutomated compliance audit finding

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions