Pin GitHub Actions to reviewed full commit SHAs

The issue points to specific lines in .github/workflows/build.yml and vendor.yml where actions like 'softprops/action-gh-release@v3' are used. Start by examining these workflow files to understand the current action references. For each action, find the commit SHA of the intended release (e.g., from the action's repository), replace the version tag with the full SHA, and add a comment. Run the workflows in a test environment to validate they still function. Ensure no other external uses: references in the workflows are missed.

Summary

GitHub Actions are referenced by mutable version tags. Pinning reviewed full commit SHAs would make action implementations immutable between reviewed updates, particularly in jobs that publish releases or update repository contents.

Severity: Low; supply-chain hardening gap, not a confirmed action compromise. Confidence: High for the configuration gap at commit 1d6777b5c087c7e31ab9b2a1237276c9fe8a0d3a.

Locations

• build.yml:250: softprops/action-gh-release@v3.
• vendor.yml:628: peter-evans/create-pull-request@v8.
• Other workflow actions, including checkout and CodeQL, also use version tags.

The build job requests contents/discussions write permissions at build.yml:34–36; the vendor job requests contents/pull-requests write permissions at vendor.yml:30–32.

Scenario and impact

If an action maintainer account or tag is compromised, a version tag could resolve to different code without any change to this repository's workflow. That code runs with the affected job's access, potentially affecting release artifacts or dependency-update changes. This is a conditional upstream-compromise risk; no compromised action or credential exposure was identified.

Recommended correction

Pin each action to a reviewed full commit SHA, retaining a version comment for readability. Keep the existing Dependabot GitHub Actions configuration so updates arrive for review. Limit write permissions to the jobs that need them.

Validation to add

Check that every external uses: reference is pinned to a full commit SHA, confirm each SHA belongs to the intended upstream release, and validate the workflows after updates. Review future pin updates before merging.

Related work

#3116 concerns downloaded vendor artifact hashes and #3118 concerns workflow interpolation/build-script expression evaluation. This issue covers the distinct action-code trust boundary. Searches of open and closed issues found no existing action SHA-pinning issue.