Repository navigation
Pin GitHub Actions to commit SHAs and base images to digests #617
Description
Part of #607.
Why
Workflows use actions by tag or branch (actions/checkout@v4, DFE-Digital/github-actions/...@master),
and the Dockerfiles use base images by tag (aspnet:10.0). A tag or branch can move. A commit SHA
or an image digest cannot.
Scope
- Pin each action to a full commit SHA, with the version in a comment.
- Pin the base images by digest.
- Rely on Dependabot (see the Dependabot issue in this epic) to keep the pins current.
- Agree with the platform team how to pin the DfE shared actions, which follow
@master.
Done when
- No workflow uses an action by tag or branch, except where the platform team agrees otherwise.
- The Dockerfiles use base images by digest.
Activity
#617 Follow the platform team's pinning rule for actions
ajs-uk-dev commentedon Oct 22, 2026
The platform team has said how to pin the DfE shared actions (22 October 2026). Their rule, in teacher-services-cloud: GitHub workflows and security:
actions/*), actions from verified publishers, and first-party actions, includingDFE-Digital/github-actions.This is the exception that "Done when" allows for. #661 follows it:
oras-project/setup-orasis the only action we use whose publisher is not verified, so it is pinned to a SHA.actions/*,azure/login,anchore/sbom-actionandDFE-Digital/github-actions/*@masterstay as they are.scripts/check-pins.shenforces this in Build.#661 closes this issue when it merges.
Merge pull request #661 from DFE-Digital/feature/617-pin_actions_and_…