ci: pin actions to SHAs
Metadata
Current evaluation
Merged canonical/craft-actions#64, pinning GitHub Actions across three CI workflow files to immutable commit SHAs to strengthen supply-chain security.
Resolution: closed resolved
Reason: canonical/craft-actions#64 was approved by two reviewers and merged. It updated 15 references in three workflow files to SHA-pinned action versions.
Evaluated by: mr-cal-bot
No scores available.
Issue body
No description provided.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged canonical/craft-actions#64, pinning GitHub Actions across three CI workflow files to immutable commit SHAs to strengthen supply-chain security. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged canonical/craft-actions#64, pinning GitHub Actions in three CI workflow files to immutable commit SHAs to improve supply-chain security. | |
| qwen/qwen3.6-35b-a3b | — | — | Changes to pin GitHub Actions to specific SHAs were merged after approval by two reviewers. The 3-file update improves CI security. All checks passed except one transient setup failure, which did not block the merge. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #173 ci: pin all actions to SHAs | starflow | closed | Merged as commit 871da43, pinning GitHub Actions to commit SHAs to resolve Zizmor advisories; the unused snap-publish workflow was deferred. | |
| #60 chore(snapcraft): pin actions to sha | craft-actions | merged | Merged #60 via commit 67304fa, pinning Snapcraft workflow actions to commit SHAs for immutable, explicitly updated dependencies. |