From 0d3aebbcbeeed7a117fb00c6f3962d8cd5fb73f4 Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Thu, 3 Sep 2026 10:25:02 -0700 Subject: [PATCH] ci: pin the actions the signing jobs newly run by commit These run with registry credentials and the OIDC token that signs under the repository's identity, so a retargeted tag upstream must not be able to reach them. Claude-Session: https://claude.ai/code/session_01A5zMqzaUg1Snur4Yg8xJGa --- .github/actions/sign-image/action.yml | 2 +- .github/workflows/container_release_unified.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/actions/sign-image/action.yml b/.github/actions/sign-image/action.yml index 405b13b3f..32b7db04e 100644 --- a/.github/actions/sign-image/action.yml +++ b/.github/actions/sign-image/action.yml @@ -15,7 +15,7 @@ runs: using: composite steps: - name: Install cosign - uses: sigstore/cosign-installer@v4.1.2 + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 - name: Sign shell: bash diff --git a/.github/workflows/container_release_unified.yml b/.github/workflows/container_release_unified.yml index 3f3aea72d..752135912 100644 --- a/.github/workflows/container_release_unified.yml +++ b/.github/workflows/container_release_unified.yml @@ -315,7 +315,7 @@ jobs: steps: - name: Checkout the signing action if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: sparse-checkout: .github/actions