Harden GitHub Actions workflows: pinning, static analysis, enforcement
Open
@ulgens is already working on this.
Since Aug 5, 2026.
DevOps
Discussion
- Dominant language
- JavaScript
- Stars
- 24k
- Forks
- 3.8k
- Avg merge
- 3d 16h
- Merged PRs (30d)
- 25
Description
Tracking issue for the GHA hardening work started in #8620 and #9032. Split out from #8674.
#8620 hardened our workflows manually, but nothing enforces it — that's how continuous-release.yml landed later with floating tags. This issue tracks closing that gap.
Scope
- Pin action refs to full SHAs — #9032 and #8620
- Keep pins fresh:
dependabot.ymlorpinact --update(needs a call on
review load) - Same treatment for
v1
To discuss
- Static analysis in CI. @ulgens proposed zizmor (+ found it via pinact). Open questions: zizmor vs actionlint vs both, and CI step vs git hook. Worth its own thread below.
cc @limzykenneth @lirenjie95
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.