Skip to content

fix: pin GitHub Actions to SHA for supply chain security - #1149

Merged
riccardosarro merged 1 commit into
masterfrom
fix/github-action-sha-pinning
May 29, 2026
Merged

riccardosarro merged 1 commit into
masterfrom
fix/github-action-sha-pinning

Conversation

@riccardosarro

Copy link
Copy Markdown
Contributor

Summary

Pin all GitHub Actions to full commit SHAs for supply chain security.

Actions referenced by tag or branch have been resolved to their commit SHA, with the original ref preserved as an inline comment. Where a sub-action had unpinned transitive dependencies, the action was upgraded to the closest newer version where all sub-actions are fully pinned.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
@riccardosarro riccardosarro added the vimeo-sha-pinning-enforcement PRs opened by gha-sha-pinning automation label May 28, 2026
@CLAassistant

CLAassistant commented May 28, 2026 •

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.


Riccardo Sarro seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
You have signed the CLA already but the status is still pending? Let us recheck it.

@codecov

codecov Bot commented May 28, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.59%. Comparing base (0db0f70) to head (8027b29).

Additional details and impacted files
@@           Coverage Diff           @@
##           master    #1149   +/-   ##
=======================================
  Coverage   72.59%   72.59%           
=======================================
  Files           7        7           
  Lines         613      613           
=======================================
  Hits          445      445           
  Misses        168      168           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@riccardosarro
riccardosarro merged commit ce600ad into master May 29, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

vimeo-sha-pinning-enforcement PRs opened by gha-sha-pinning automation

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants