Repository navigation
Pin third-party actions to commit SHAs (fixes 3 CodeQL unpinned-tag alerts) - #14
Merged
Merged
Conversation
Pin the three refs CodeQL flagged as actions/unpinned-tag so workflows
no longer resolve mutable tags at run time:
- opencode.yml: anomalyco/opencode/github@latest (moving tag) pinned to
77fc88c8ade8e5a620ebbe1197f3a572d29ae91a (peeled refs/tags/latest^{})
- claude.yml / claude-code-review.yml: anthropics/claude-code-action@v1
pinned to 5eb090f3c3afd701a0672cd32981197ca27688f6 (peeled refs/tags/v1^{})
Human tags kept as trailing comments so Dependabot can still update pins.
Closes CodeQL alerts #1, #2, #3 once merged to main and re-analyzed.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the three open CodeQL
actions/unpinned-tagalerts by pinning exactly the flagged third-partyuses:refs to full 40-char commit SHAs (annotated tags peeled viarefs/tags/<tag>{}). Human tags kept as trailing comments so Dependabot can still update the pins. No version bumps.Per-alert mapping
.github/workflows/opencode.yml:35anomalyco/opencode/github@latest(moving tag — worst of the three)@77fc88c8ade8e5a620ebbe1197f3a572d29ae91a+# latest @ 2026-10-19.github/workflows/claude-code-review.yml:36anthropics/claude-code-action@v1@5eb090f3c3afd701a0672cd32981197ca27688f6+# v1.github/workflows/claude.yml:35anthropics/claude-code-action@v1@5eb090f3c3afd701a0672cd32981197ca27688f6+# v1Verification
git ls-remote ... 'refs/tags/v1' 'refs/tags/v1^{}'/refs/tags/latest{^}; both are annotated tags (tag object → peeled commit). Pins resolve as commits viagh api repos/.../commits/<sha>.action.ymlinspected at each pinned SHA:anthropics/claude-code-action: nesteduses: oven-sh/setup-bun@0c5077e…is already SHA-pinned; install isbun install --productionfrom its own checked-out source; the onecurlis a token-revocation DELETE, not an install. No mutable installs.anomalyco/opencode/github:action.ymlinternally doescurl …/releases/latestandcurl -fsSL https://opencode.ai/install | bashat run time. Pinning the wrapper closes the flagged CodeQL alert (theuses:ref is no longer mutable) but is not full immutability — the caller cannot pin the action's internal install path. Longer-term options: vendor the action under.github/actions/, replace with explicit version-pinned install steps, or drop the workflow.actionlint1.7.7: exit 0 on all three workflows; YAML parse-validated.net8.0-windows), and the change touches no C#.Alerts close when this reaches
mainand the next CodeQL analysis runs.