Repository navigation
ci: pin every action to a commit SHA [PLT-2594] - #1
Merged
charles-spectora merged 1 commit intoOct 20, 2026
Conversation
Pin every third-party action in the fork's workflow to a full commit SHA (newest release within the major already in use, tag as a trailing comment) and add a github-actions Dependabot ecosystem. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
viniciuscbm
approved these changes
Oct 13, 2026
viniciuscbm
left a comment
There was a problem hiding this comment.
Thanks, Charles. I verified that every pinned SHA exists upstream and matches the version in its trailing comment, that no action changes major version, and that zizmor 1.30.1 and actionlint report no new findings against the base branch. The Dependabot config looks good as well.
The failing checks are not caused by this change: the workflow logic is unchanged apart from the pins, and this repository has no passing CI baseline on its default branch.
Approving.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes PLT-2594 and this repo's share of PLT-2441 (SAST A7, pin third-party actions).
Pipeline config only. No runtime code changes. This is a fork of
deepak786/intercom_flutter, and this PR makes it diverge from upstream in.github/only.What changed
Third-party actions pinned to full SHAs, release tag as a trailing comment. Each one is the newest release within the major the workflow already used, so nothing crosses a major. That covers all 9
uses:lines inmain.yml. The repo has no composite actions,spectorasoftware/github-actionscomposites orshared-pipelinesrefs.actions/checkoutv2v2.8.0actions/setup-javav1v1.4.5subosito/flutter-actionv1v1.5.3nanasess/setup-chromedriverv2v2.4.0.github/dependabot.ymlis new. It adds agithub-actionsecosystem for the workflow (weekly, grouped, 7-day cooldown). Dependabot version updates are off by default on forks, so this needs enabling in the repo's settings before it does anything.Verified
p/github-actions: 9github-actions-mutable-action-tagresults on master, 0 on this branch.main.ymlanddependabot.ymlparse..github/.Worth a look in review
main.ymlruns on pull requests to master, so this PR is its first run here. It's upstream's older workflow (setup-java@v1with Java 12,subosito/flutter-action@v1), and it may fail for reasons unrelated to the pins. Moving to newer majors is outside this ticket.🤖 Generated with Claude Code