Pin GitHub Actions to full commit SHAs for supply-chain security
Open
@podkidyshev is already working on this.
Since Jun 15, 2026.
maintenance
- Dominant language
- Python
- Stars
- 99
- Forks
- 62
- Avg merge
- 6d 12h
- Merged PRs (30d)
- 17
Description
Summary
All GitHub Actions referenced in .github/workflows/ci.yml are currently pinned to mutable tag references (e.g., @v5, @v6). Mutable tags can be moved by upstream maintainers or attackers to point to a different (potentially malicious) commit, introducing a supply-chain risk.
Actions to pin
The following action references should be updated to use their full commit SHA, with the human-readable tag preserved in an inline comment:
actions/checkout@v6(lines 15, 51)actions/setup-python@v6(lines 18, 56)astral-sh/setup-uv@v5(lines 21, 61)
Example fix
- name: Install uv
uses: astral-sh/setup-uv@<full_commit_sha> # v5
Apply the same pattern to all occurrences of actions/checkout and actions/setup-python.
References
- Raised in PR #925 (comment: https://github.com/NVIDIA/cloudai/pull/925#discussion_r3414093349)
- Detected by zizmor (unpinned-uses)
- Requester: @podkidyshev
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.