ci: pin all actions to SHAs
Metadata
Current evaluation
Merged as commit 871da43, pinning GitHub Actions to commit SHAs to resolve Zizmor advisories; the unused snap-publish workflow was deferred.
Resolution: closed resolved
Reason: The approved PR was merged as commit 871da43. It pinned workflow actions to immutable SHAs, while explicitly leaving the unused snap-publish workflow for separate handling.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Fixes many Zizmor advisories about unpinned workflows.
The only remaining unpinned workflow is in the `starflow/snap-publish`, which appears unused. That one will be handled separately, as there isn't a good candidate to begin pinning to.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged as commit 871da43, pinning GitHub Actions to commit SHAs to resolve Zizmor advisories; the unused snap-publish workflow was deferred. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged canonical/starflow#173, pinning GitHub Actions to commit SHAs to resolve Zizmor advisories. The unused starflow/snap-publish workflow was explicitly deferred for separate handling. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged changes pinning all GitHub Actions to SHA hashes to resolve Zizmor security advisories. One unused workflow remains unpinned for separate handling. Approved and passed CI checks. | |
| qwen/qwen3.6-35b-a3b |
Impact:
40
Quick Win:
36
Staleness:
0
Complexity:
10
Confidence:
75
|
needs review | Pins GitHub Actions to SHAs to address Zizmor security advisories. Approved by 1 reviewer with mostly passing CI (one failing check on focal). | |
| qwen/qwen3.6-35b-a3b |
Impact:
50
Quick Win:
40
Staleness:
0
Complexity:
20
Confidence:
70
|
needs review | Pins all GitHub Actions to SHAs to fix Zizmor security advisories. CI passing, pending maintainer review. |
Update history
| Date | Change |
|---|---|
| closed | |
| updated | |
| created |
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #64 ci: pin actions to SHAs | craft-actions | merged | Merged canonical/craft-actions#64, pinning GitHub Actions across three CI workflow files to immutable commit SHAs to strengthen supply-chain security. | |
| #60 chore(snapcraft): pin actions to sha | craft-actions | merged | Merged #60 via commit 67304fa, pinning Snapcraft workflow actions to commit SHAs for immutable, explicitly updated dependencies. | |
| #403 CI: zizmor flags unpinned GitHub Actions in check-renovate.yaml / release-publish.yaml | imagecraft | closed | Resolved in #585: actions pinned to commit SHAs in check-renovate.yaml and release-publish.yaml; softprops/action-gh-release replaced with gh release create. |