From abb847130cf6045e79e3f92289a3d2a3dde69a66 Mon Sep 17 00:00:00 2001 From: HF Pin SHA Versions Auto-Fix Date: Thu, 21 May 2026 15:15:21 +0000 Subject: [PATCH] chore(security): auto-pin GitHub Actions to SHAs Auto-pinned by huggingface/tracking-issues/.github/workflows/security-workflow-scan.yml. --- .github/workflows/codeql-reusable.yml | 8 ++++---- .github/workflows/codeql.yml | 2 +- .github/workflows/manual-create-release.yml | 4 ++-- .github/workflows/octoscan-reusable.yml | 10 +++++----- .github/workflows/permissions-advisor-reusable.yml | 6 +++--- .../semantic-create-release-and-update-major.yml | 2 +- .github/workflows/update-major-version-tag.yml | 4 ++-- .pinact.yaml | 11 +++++++++++ 8 files changed, 29 insertions(+), 18 deletions(-) create mode 100644 .pinact.yaml diff --git a/.github/workflows/codeql-reusable.yml b/.github/workflows/codeql-reusable.yml index 3ba0330..e05803c 100644 --- a/.github/workflows/codeql-reusable.yml +++ b/.github/workflows/codeql-reusable.yml @@ -45,10 +45,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 with: languages: ${{ matrix.language }} queries: ${{ inputs.queries }} @@ -56,7 +56,7 @@ jobs: config: ${{ vars.CODEQL_ORG_CONFIG }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 with: category: "/language:${{ matrix.language }}" upload: always @@ -64,7 +64,7 @@ jobs: - name: Upload results artifact if: always() - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: codeql-results-${{ matrix.language }} path: sarif-results/${{ matrix.language }}.sarif diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index d02a93a..43fcaa1 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -10,7 +10,7 @@ on: jobs: codeql: name: CodeQL Analysis - uses: huggingface/security-workflows/.github/workflows/codeql-reusable.yml@v1.2.0 + uses: huggingface/security-workflows/.github/workflows/codeql-reusable.yml@e0d40aaf3c566a5e820787840453f45f909e337f # v1.2.0 permissions: security-events: write packages: read diff --git a/.github/workflows/manual-create-release.yml b/.github/workflows/manual-create-release.yml index 7efbc33..e4598de 100644 --- a/.github/workflows/manual-create-release.yml +++ b/.github/workflows/manual-create-release.yml @@ -17,7 +17,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 @@ -46,4 +46,4 @@ jobs: run: | echo "## No Release Published" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY - echo "No changes detected that warrant a new release." >> $GITHUB_STEP_SUMMARY \ No newline at end of file + echo "No changes detected that warrant a new release." >> $GITHUB_STEP_SUMMARY diff --git a/.github/workflows/octoscan-reusable.yml b/.github/workflows/octoscan-reusable.yml index 33ab869..a7dd3ca 100644 --- a/.github/workflows/octoscan-reusable.yml +++ b/.github/workflows/octoscan-reusable.yml @@ -38,27 +38,27 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Run Octoscan id: octoscan - uses: synacktiv/action-octoscan@v1 + uses: synacktiv/action-octoscan@6b1cf2343893dfb9e5f75652388bd2dc83f456b0 # v1.0.0 with: disable_rules: ${{ inputs.disable_rules }} filter_triggers: ${{ inputs.filter_triggers }} - name: Upload SARIF to Security tab if: always() - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@458d36d7d4f47d0dd16ca424c1d3cda0060f1360 # v3.35.5 with: sarif_file: "${{ steps.octoscan.outputs.sarif_output }}" category: octoscan - name: Upload results artifact if: always() && inputs.generate_summary - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: octoscan-results path: results.json retention-days: 30 - if-no-files-found: ignore \ No newline at end of file + if-no-files-found: ignore diff --git a/.github/workflows/permissions-advisor-reusable.yml b/.github/workflows/permissions-advisor-reusable.yml index 884f6ca..3d3a070 100644 --- a/.github/workflows/permissions-advisor-reusable.yml +++ b/.github/workflows/permissions-advisor-reusable.yml @@ -26,10 +26,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Run Advisor - uses: GitHubSecurityLab/actions-permissions/advisor@v1 + uses: GitHubSecurityLab/actions-permissions/advisor@bf82d13b9b10051d224345ab9184f5ede0a94289 # v1.0.2-beta9 with: name: ${{ inputs.workflow_name }} - count: ${{ inputs.run_count }} \ No newline at end of file + count: ${{ inputs.run_count }} diff --git a/.github/workflows/semantic-create-release-and-update-major.yml b/.github/workflows/semantic-create-release-and-update-major.yml index aa7e41d..1c80b3d 100644 --- a/.github/workflows/semantic-create-release-and-update-major.yml +++ b/.github/workflows/semantic-create-release-and-update-major.yml @@ -16,7 +16,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 diff --git a/.github/workflows/update-major-version-tag.yml b/.github/workflows/update-major-version-tag.yml index 9f7bfd4..3604e53 100644 --- a/.github/workflows/update-major-version-tag.yml +++ b/.github/workflows/update-major-version-tag.yml @@ -21,7 +21,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 @@ -44,4 +44,4 @@ jobs: run: | git tag -f ${{ inputs.major_tag }} ${{ inputs.source_tag }} git push origin ${{ inputs.major_tag }} --force - echo "Tag ${{ inputs.major_tag }} has been created and redirect to ${{ inputs.source_tag }}" \ No newline at end of file + echo "Tag ${{ inputs.major_tag }} has been created and redirect to ${{ inputs.source_tag }}" diff --git a/.pinact.yaml b/.pinact.yaml new file mode 100644 index 0000000..e739344 --- /dev/null +++ b/.pinact.yaml @@ -0,0 +1,11 @@ +version: 3 + +# Self-pin: this repo eats its own dog food. +# Every `uses:` in our own workflows must be pinned to a 40-char SHA. + +files: + - pattern: .github/workflows/*.yml + - pattern: .github/workflows/*.yaml + +min_age: + value: 7 # refuse adopting a release younger than 7 days