GitHub Script action not pinned to a full-length commit SHA

Open

#169 opened on Mar 18, 2026 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 1/5
Estimated time: Under an hour
Newbie friendliness: 55/100

Issue type: Bug
Clarity: Clearly specified
Activity status: Stale
Tech stack: github-actions
Domain: ci-cd, security

Research direction

Start with action.yml at line 137, referenced in the issue, and inspect the accessibility-scanner workflow's actions/github-script usage. Update the action reference to a full-length commit SHA, then verify that the workflow satisfies the repository's pinning requirement and runs successfully.

Written by the indexing model from the issue text.

Description

The accessibility-scanner workflow uses actions/github-script@v8 without pinning it to a specific commit SHA. This violates security best practices and causes the pipeline to fail when the Require actions to be pinned to a full-length commit SHA setting is enabled.

Steps to Reproduce

Enable Require actions to be pinned to a full-length commit SHA in the repository settings.
Run the accessibility-scanner workflow.
Observe the failure caused by the unpinned actions/github-script action.

Expected Behavior

The workflow should run successfully with all actions pinned to full-length commit SHAs.

Actual Behavior

The workflow fails because actions/github-script@v8 is not pinned to a commit SHA.

https://github.com/github/accessibility-scanner/blob/db51bb5d470a862cc027836ee1583ab9d5ae5b16/action.yml#L137

Dominant language: TypeScript
Stars: 374
Forks: 42
Avg merge: 1d 13h
Merged PRs (30d): 7

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

[MagmaFusion] rapports qualité - contenus des rubriques en anglais manquants Open

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

InseeFr/Bauhaus#1634 · Opened Sep 23, 2026
[Bug]: SSH host picker duplicates configured aliases and known_hosts targets Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

pingdotgg/t3code#13270 · Opened Sep 23, 2026
resetSseResponseWait and noteRequestProgress silently fail to re-arm the 60s relay timeout if progress tokens arrive as strings Open

bug v2

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

modelcontextprotocol/inspector#2458 · 1 comment · Opened Sep 23, 2026
Resources: Update work of changsha Open

Difficulty 1/5 Under an hour Newbie friendliness 75/100

railmapgen/rmp-gallery#4068 · Opened Sep 23, 2026
sass-1.105.0.tgz: 1 vulnerabilities (highest severity is: 7.5) Open

Mend: dependency security vulnerability status: needs triage 🕵️‍♀️

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

carbon-design-system/ibm-products#9907 · Opened Sep 23, 2026

More TypeScript issues