chore(snapcraft): pin actions to sha
Metadata
Current evaluation
Merged #60 via commit 67304fa, pinning Snapcraft workflow actions to commit SHAs for immutable, explicitly updated dependencies.
Resolution: closed resolved
Reason: PR canonical/craft-actions#60 was approved and merged as commit 67304fa. It replaced mutable Snapcraft action references with immutable commit SHAs.
Evaluated by: mr-cal-bot
No scores available.
Issue body
In a current state pinning the `craft-actions/` creates a mutable workflow that depends on a dynamic version of the downstream actions.
To make this workflow immutable downstream workflows should be pinned, and their changes should be updated with an explicit commit.
E.g. First line of `setup-lxd` action clearly states:
```
NB: this action is currently in alpha, breaking changes can occur at any time. Please pin a SHA or exact version in your CI.
```
This PR proposes pinning for `snapcraft/` branch
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged #60 via commit 67304fa, pinning Snapcraft workflow actions to commit SHAs for immutable, explicitly updated dependencies. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged canonical/craft-actions#60, pinning Snapcraft workflow actions to commit SHAs for immutable, explicitly updated dependencies. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged changes pinning craft-actions to specific commit SHAs to ensure immutable Snapcraft workflows and prevent breaking changes from alpha dependencies. Approved by two reviewers and passed all CI checks. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged. Pinned craft-actions to specific SHAs to ensure workflow immutability and prevent breaking changes from dynamic versions on the snapcraft branch. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #173 ci: pin all actions to SHAs | starflow | closed | Merged as commit 871da43, pinning GitHub Actions to commit SHAs to resolve Zizmor advisories; the unused snap-publish workflow was deferred. | |
| #64 ci: pin actions to SHAs | craft-actions | merged | Merged canonical/craft-actions#64, pinning GitHub Actions across three CI workflow files to immutable commit SHAs to strengthen supply-chain security. | |
| #713 chore(ci): move actions from snapcore to canonical | rockcraft | merged | Merged PR #713 as commit 46a5eecc, moving CI actions from snapcore to canonical across three workflow files. |