chore(ci): SHA-pin third-party GitHub Actions refs#4
Conversation
Pins every external `uses:` ref to a commit SHA with a trailing `# <tag>` comment. Closes the tj-actions-class supply-chain attack vector where a malicious tag push exfiltrates secrets. Dependabot continues to update via the version comment. Action refs that can't be pinned (e.g. `dtolnay/rust-toolchain@stable` which is intentionally a moving ref) are left as-is — these are floating channel refs, not tag refs.
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 34 minutes and 34 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Summary
Mechanical sweep: pin every third-party GitHub Actions
uses:ref to a commit SHA with a trailing# <tag>comment. Dependabot keeps working through the version comment.Closes the tj-actions/changed-files-class supply-chain attack vector — a malicious tag push on a popular action can no longer hijack our runs.
Unpinnable channel refs (e.g.
dtolnay/rust-toolchain@stable) are left as-is by design.Generated with pinact.
Test plan
🤖 Generated with Claude Code