From 9ad23c0474e83553400040319f2e4c1d27dbc383 Mon Sep 17 00:00:00 2001
From: Maciej Mensfeld <maciej@mensfeld.pl>
Date: Tue, 3 Nov 2026 15:30:51 +0100
Subject: [PATCH] ci: require a full commit SHA for every action in
 verify-action-pins

The old check only caught @vN, @main and @master, and skipped every line with
a comment, so @v4.1.0, '@v4 # note' and other branch names passed. Now any
uses: whose ref is not a 40-character SHA fails; local ./ actions and docker://
images are not checked.
---
 .github/workflows/verify-action-pins.yml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/verify-action-pins.yml b/.github/workflows/verify-action-pins.yml
index 6e28625..01b0afc 100644
--- a/.github/workflows/verify-action-pins.yml
+++ b/.github/workflows/verify-action-pins.yml
@@ -12,7 +12,14 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Check SHA pins
         run: |
-          if grep -E -r "uses: .*/.*@(v[0-9]+|main|master)($|[[:space:]]|$)" --include="*.yml" --include="*.yaml" .github/workflows/ | grep -v "#"; then
+          # Every remote action must be pinned to a full 40-character commit SHA. Local actions
+          # (./) and docker:// images are not checked.
+          unpinned=$(grep -E -rn --include="*.yml" --include="*.yaml" \
+            "^[[:space:]]*(-[[:space:]]+)?uses:[[:space:]]*['\"]?[^.'\"[:space:]]" .github/workflows/ \
+            | grep -Ev "uses:[[:space:]]*['\"]?docker://" \
+            | grep -Ev "@[0-9a-f]{40}['\"]?([[:space:]]|$)" || true)
+          if [ -n "$unpinned" ]; then
+            echo "$unpinned"
             echo "::error::Actions should use SHA pins, not tags or branch names"
             exit 1
           fi