Skip to content

chore: pin GitHub Actions to SHA for supply chain security #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
luis-hong wants to merge 12 commits into from
Closed

chore: pin GitHub Actions to SHA for supply chain security #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
07f1e99
chore: pin GitHub Actions to SHA (.github/workflows/enforce-license-c…
luis-hong Feb 20, 2026
fb9dd61
chore: pin GitHub Actions to SHA (.github/workflows/integration-tests…
luis-hong Feb 20, 2026
9ddcade
chore: pin GitHub Actions to SHA (.github/workflows/release.yml)
luis-hong Feb 20, 2026
ca877b6
chore: add security-check workflow for SHA pinning CI
luis-hong Feb 23, 2026
ee0b629
chore: pin OFFICIAL, VERIFIED_CLOUD actions to SHA (.github/workflows…
luis-hong Feb 23, 2026
d1f3c3c
chore: pin OFFICIAL, VERIFIED_CLOUD actions to SHA (.github/workflows…
luis-hong Feb 23, 2026
23f5074
chore: pin OFFICIAL, VERIFIED_CLOUD actions to SHA (.github/workflows…
luis-hong Feb 23, 2026
e599621
chore: pin OFFICIAL, VERIFIED_CLOUD actions to SHA (.github/workflows…
luis-hong Feb 23, 2026
c5cc843
chore: pin OFFICIAL, VERIFIED_CLOUD actions to SHA (.github/workflows…
luis-hong Feb 23, 2026
21d827e
chore: pin OFFICIAL, VERIFIED_CLOUD actions to SHA (.github/workflows…
luis-hong Feb 23, 2026
031363e
chore: pin OFFICIAL, VERIFIED_CLOUD actions to SHA (.github/workflows…
luis-hong Feb 23, 2026
0b17641
chore: pin OFFICIAL, VERIFIED_CLOUD actions to SHA (.github/workflows…
luis-hong Feb 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,16 +21,16 @@ jobs:

steps:
- name: Git checkout
uses: actions/checkout@v3
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3

- name: 'Set up Java: ${{ matrix.java }}'
uses: actions/setup-java@v3
uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3
with:
java-version: ${{ matrix.java }}
distribution: 'temurin'

- name: Cache Gradle packages
uses: actions/cache@v2
uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace # v2
Comment on lines 32 to +33
Copy link

@coderabbitai coderabbitai bot Feb 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

actions/cache@v2가 더 이상 지원되지 않습니다.

actions/cache의 일부 버전이 더 이상 지원되지 않습니다. 2025년 2월 1일 이전에 v4 또는 v3으로 업그레이드하는 것이 권장되며, 핀된 SHA를 사용하는 경우 v4.2.0 또는 v3.4.0의 SHA를 사용해야 합니다.

이 PR의 목적이 공급망 보안이지만, 더 이상 지원되지 않는 v2 SHA를 핀하면 워크플로우가 실패합니다.

🔧 v4로 업그레이드 제안 
      - name: Cache Gradle packages
-       uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace  # v2
+       uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684  # v4
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/build.yml around lines 32 - 33, The workflow pins an
unsupported actions/cache SHA (uses:
actions/cache@8492260343ad570701412c2f464a5877dc76bace) which is v2 and will
fail; update the uses entry to a supported release (prefer actions/cache@v4) or
if you must pin a commit SHA use the v4.2.0 or v3.4.0 SHAs as recommended,
replacing the current pinned SHA in the "uses: actions/cache@..." line so the
workflow uses a supported version.

with:
path: |
~/.gradle/caches
Expand All @@ -51,7 +51,7 @@ jobs:
- name: Archive packages
# We need artifacts from only one the builds
if: runner.os == 'Linux' && matrix.java == '17'
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3
with:
name: ${{ github.sha }}
if-no-files-found: error
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/codeql-analysis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,16 +21,16 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v3
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3

- name: 'Set up Java: ${{ matrix.java }}'
uses: actions/setup-java@v3
uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3
Comment on lines 26 to +27
Copy link

@coderabbitai coderabbitai bot Feb 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

matrix.java가 정의되지 않았습니다 (기존 버그).

정적 분석 도구(actionlint)가 19-20번 줄의 matrix 정의에서 java 속성이 존재하지 않음을 지적했습니다. matrix는 language: ['cpp', 'java']만 정의하고 있어서 ${{ matrix.java }}는 항상 빈 문자열로 평가됩니다.

이것은 이 PR에서 도입된 문제가 아닌 기존 버그입니다.

🐛 step name 수정 제안 
-     - name: 'Set up Java: ${{ matrix.java }}'
+     - name: 'Set up Java: 17'
🧰 Tools
🪛 actionlint (1.7.11)

[error] 26-26: property "java" is not defined in object type {language: string}

(expression)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/codeql-analysis.yml around lines 26 - 27, The step name
references an undefined matrix variable (matrix.java) which is always empty; fix
by either adding a java entry to the matrix (e.g., add matrix.java with
versions) so ${ matrix.java } is populated, or simpler: remove the interpolation
from the step name and use a static name like "Set up Java" and guard the step
with an if condition (e.g., if: matrix.language == 'java') so actions/setup-java
runs only for Java matrix entries; update the step’s name line and, if you
choose the matrix change, add the new java key to the matrix definition so
actions/setup-java@... and the name use the defined variable.

with:
java-version: 17
distribution: 'temurin'

- name: Cache Gradle packages
uses: actions/cache@v2
uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace # v2
Comment on lines 32 to +33
Copy link

@coderabbitai coderabbitai bot Feb 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

actions/cache@v2가 더 이상 지원되지 않습니다.

actions/cache의 일부 버전이 더 이상 지원되지 않으며, 업그레이드하지 않으면 워크플로우가 실패합니다.

🔧 v4로 업그레이드 제안 
      - name: Cache Gradle packages
-       uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace  # v2
+       uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684  # v4
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Cache Gradle packages
uses: actions/cache@v2
uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace # v2
- name: Cache Gradle packages
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/codeql-analysis.yml around lines 32 - 33, The workflow
step "Cache Gradle packages" is using the deprecated actions/cache@v2; update
that step to use the supported major version by changing the uses reference from
actions/cache@v2 (or the specific commit) to actions/cache@v4, ensuring the step
name "Cache Gradle packages" and any associated with: keys (e.g., path, key,
restore-keys) remain intact so the cache behavior is preserved.

with:
path: |
~/.gradle/caches
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/enforce-license-compliance.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,6 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: 'Enforce License Compliance'
uses: getsentry/action-enforce-license-compliance@main
uses: getsentry/action-enforce-license-compliance@48236a773346cb6552a7bda1ee370d2797365d87 # main
with:
fossa_api_key: ${{ secrets.FOSSA_API_KEY }}
6 changes: 3 additions & 3 deletions .github/workflows/format-code.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,16 +8,16 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v3
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3

- name: set up JDK 17
uses: actions/setup-java@v3
uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3
with:
distribution: 'temurin'
java-version: '17'

- name: Cache Gradle packages
uses: actions/cache@v2
uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace # v2
Comment on lines 19 to +20
Copy link

@coderabbitai coderabbitai bot Feb 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

actions/cache@v2가 더 이상 지원되지 않습니다.

actions/cache의 일부 버전이 더 이상 지원되지 않으며, 업그레이드하지 않으면 워크플로우가 실패합니다. v4 또는 최소 v3.4.0 이상으로 업그레이드가 필요합니다.

🔧 v4로 업그레이드 제안 
      - name: Cache Gradle packages
-       uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace  # v2
+       uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684  # v4
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/format-code.yml around lines 19 - 20, The workflow step
named "Cache Gradle packages" currently pins actions/cache to an unsupported
commit hash (uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace);
update that uses: reference to a supported release by replacing the pinned hash
with a supported version tag such as actions/cache@v4 (or at minimum
actions/cache@v3.4.0) so the GitHub Actions runner uses a maintained release and
the workflow no longer fails.

with:
path: |
~/.gradle/caches
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/generate-javadocs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,15 +9,15 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout 🛎️
uses: actions/checkout@v3
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
- name: set up JDK 17
uses: actions/setup-java@v3
uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3
with:
distribution: 'temurin'
java-version: '17'

- name: Cache Gradle packages
uses: actions/cache@v2
uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace # v2
Comment on lines +12 to +20
Copy link

@coderabbitai coderabbitai bot Feb 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

actions/cache v2 deprecation 2025 github actions

💡 Result:

actions/cache@v2 (and @v1) was deprecated as part of GitHub Actions’ cache-service migration:

  • Deprecation began: February 1, 2025 (cache v1–v2 deprecation starts) [1]
  • Fully retired / hard-fail date: March 1, 2025 (workflows using v1/v2 can fail) [1]
  • GitHub recommended upgrading to actions/cache@v3 or @v4 (and newer releases exist, e.g. @v5) [1][2].
  • The underlying @actions/cache toolkit package likewise required upgrading (e.g., to 4.0.0+) to avoid failures after the retirement date [3].

What to do (workflow fix):

- uses: actions/cache@v4
  with:
    path: ~/.cache
    key: ${{ runner.os }}-cache-${{ hashFiles('**/lockfiles') }}

(Or use actions/cache@v5 if you’re ready for its runtime/runner requirements.) [2]

Sources: [1] GitHub Changelog (Sep 16, 2024 notice) (github.blog), [2] actions/cache repo docs/announcement (github.com), [3] @actions/cache toolkit deprecation notice (github.com)

Citations:

🌐 Web query:

actions/cache v4 latest sha github

💡 Result:

The current commit SHA that the actions/cache@v4 tag points to is:

  • 0057852bfaa89a56745cba8c7296529d2fc39830 (tag v4, dated Sep 24, 2025) [1][2]

Sources:
[1] https://github.com/actions/cache/tags
[2] actions/cache@0057852

🌐 Web query:

github actions cache deprecated february 2025 status

💡 Result:

As of February 2025, GitHub had started moving Actions cache storage to a new cache service architecture (v2 APIs) starting February 1, 2025, and deprecated/closed down actions/cache v1–v2 (and @actions/cache package versions < 4.0.0). Runs using the retired versions were expected to fail after full retirement on March 1, 2025. [1][2]

What you needed to do (Feb 2025):

  • Upgrade workflows to use actions/cache@v3 or actions/cache@v4 (and avoid pinning to old SHAs). [1][2]
  • If you use the toolkit package directly, bump to @actions/cache >= 4.0.0. [3]

Feb 2025 operational status:

  • GitHub scheduled “brownouts” (intentional failures) to surface breakages on Feb 4, Feb 11, and Feb 18, 2025 (UTC). [1][2]

Key dates:

  • Feb 1, 2025: new cache storage architecture rollout; v1–v2 deprecated/closing down. [1][2]
  • Mar 1, 2025: full retirement; deprecated versions expected to fail. [1][2]

Note: GitHub stated this did not impact GitHub Enterprise Server customers in the same way (they could continue using versions without the hosted-service retirement behavior). [1][2]

Sources: [1] [2] [3]

actions/cache@v2 완전 중단으로 인해 워크플로우가 현재 실패 중입니다.

actions/cache@v2는 2025년 3월 1일부로 완전히 중단되었습니다. 현재(2026년 2월) 이 버전을 사용하는 워크플로우는 실패합니다. v3 또는 v4로 즉시 업그레이드해야 합니다.

v4로 업그레이드 제안 
      - name: Cache Gradle packages
-       uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace  # v2
+       uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
        with:
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/generate-javadocs.yml around lines 12 - 20, The workflow
step named "Cache Gradle packages" uses the deprecated pinned ref
actions/cache@8492260343ad570701412c2f464a5877dc76bace (v2) and is causing CI
failures; update that step to use the supported actions/cache@v4 reference (or
actions/cache@v3 if you prefer v3), keeping the existing inputs intact, then
commit and re-run the .github/workflows/generate-javadocs.yml workflow to verify
the failure is resolved.

with:
path: |
~/.gradle/caches
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/gradle-wrapper-validation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,5 +10,5 @@ jobs:
validation:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
- uses: gradle/wrapper-validation-action@55e685c48d84285a5b0418cd094606e199cca3b6 # pin@v1
12 changes: 6 additions & 6 deletions .github/workflows/integration-tests-benchmarks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,10 +22,10 @@ jobs:

steps:
- name: Git checkout
uses: actions/checkout@v3
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3

- name: 'Set up Java: 17'
uses: actions/setup-java@v3
uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3
with:
java-version: '17'
distribution: 'temurin'
Expand Down Expand Up @@ -64,15 +64,15 @@ jobs:

steps:
- name: Git checkout
uses: actions/checkout@v3
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3

- name: 'Set up Java: 17'
uses: actions/setup-java@v3
uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3
with:
java-version: '17'
distribution: 'temurin'

- uses: actions/cache@v3
- uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3
id: app-plain-cache
with:
path: sentry-android-integration-tests/test-app-plain/build/outputs/apk/release/test-app-plain-release.apk
Expand All @@ -86,7 +86,7 @@ jobs:
run: ./gradlew :sentry-android-integration-tests:test-app-sentry:assembleRelease

- name: Collect app metrics
uses: getsentry/action-app-sdk-overhead-metrics@v1
uses: getsentry/action-app-sdk-overhead-metrics@c9eca50e02d180ee07a02952c062b2f3f545f735 # v1
with:
config: sentry-android-integration-tests/metrics-test.yml
sauce-user: ${{ secrets.SAUCE_USERNAME }}
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/integration-tests-ui.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,10 +17,10 @@ jobs:

steps:
- name: Git checkout
uses: actions/checkout@v3
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3

- name: 'Set up Java: 17'
uses: actions/setup-java@v3
uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3
with:
java-version: '17'
distribution: 'temurin'
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,12 +17,12 @@ jobs:
runs-on: ubuntu-latest
name: "Release a new version"
steps:
- uses: actions/checkout@v3
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
with:
token: ${{ secrets.GH_RELEASE_PAT }}
fetch-depth: 0
- name: Prepare release
uses: getsentry/action-prepare-release@v1
uses: getsentry/action-prepare-release@c8e1c2009ab08259029170132c384f03c1064c0e # v1
env:
GITHUB_TOKEN: ${{ secrets.GH_RELEASE_PAT }}
with:
Expand Down
8 changes: 8 additions & 0 deletions .github/workflows/security-check.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
name: Security Check
on:
pull_request:

jobs:
security-check:
uses: Buzzvil/workflows/.github/workflows/security-check.yaml@main
Copy link

@github-actions github-actions bot Feb 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • 🚫 Please pin the action by specifying a commit SHA instead of a tag/branch.

Copy link

@coderabbitai coderabbitai bot Feb 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

# Check the full content of the security-check.yaml file
cat -n .github/workflows/security-check.yaml 2>/dev/null || echo "File not found or cannot be read"

Repository: Buzzvil/sentry-java

Length of output: 276

🏁 Script executed:

# Search for any other workflow files in the repository to understand the pinning pattern
fd "\.yaml$|\.yml$" .github/workflows/ | head -20

Repository: Buzzvil/sentry-java

Length of output: 565

🏁 Script executed:

# Check git history to understand the PR context and pinning goal
git log --oneline -20 -- ".github/workflows/" 2>/dev/null | head -10

Repository: Buzzvil/sentry-java

Length of output: 125

🌐 Web query:

Buzzvil/workflows GitHub repository security-check.yaml reusable workflow recommended commit SHA pinning

💡 Result:

I couldn’t locate a public Buzzvil/workflows GitHub repository (the URL returns 404 Not Found in this environment), so I can’t tell you the exact commit SHA that security-check.yaml should be pinned to.

That said, for reusable workflows, GitHub explicitly supports referencing the called workflow by commit SHA, tag, or branch, and states that using a commit SHA is the safest option for stability and security. [1]

Recommended pinning (caller workflow)

jobs:
  security_check:
    uses: Buzzvil/workflows/.github/workflows/security-check.yaml@<FULL_COMMIT_SHA>

How to get the correct SHA to pin

  1. Open security-check.yaml in the Buzzvil/workflows repo.
  2. Click History for that file.
  3. Copy the full commit SHA for the exact revision you want to trust, and use it in @<FULL_COMMIT_SHA>.

If you paste the repository URL (or confirm it’s private and share the file’s “History” page output), I can tell you which SHA corresponds to the latest version.

Sources: [1]

커밋 SHA로 고정하세요.

현재 @main은 변동 가능하며 공급망 위험을 야기합니다. PR 목표인 액션 SHA 고정과 일치하도록 Buzzvil/workflows 저장소의 안정적인 커밋 SHA로 교체가 필요합니다.

✅ 제안 수정 
-    uses: Buzzvil/workflows/.github/workflows/security-check.yaml@main
+    uses: Buzzvil/workflows/.github/workflows/security-check.yaml@<PINNED_SHA>
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/security-check.yaml at line 7, 현재 "uses:
Buzzvil/workflows/.github/workflows/security-check.yaml@main" 참조가 가변적인 `@main`
브랜치를 사용하므로 공급망 위험이 있습니다; 해당 참조를 Buzzvil/workflows 저장소의 안정적인 커밋 SHA로 교체하세요 (예:
"uses: Buzzvil/workflows/.github/workflows/security-check.yaml@<COMMIT_SHA>") —
즉, 현재 파일의 uses 항목을 찾아 위 문자열의 `@main` 부분을 정확한 커밋 SHA로 대체하고 변경사항을 커밋하여 PR에 반영하세요.

secrets: inherit
Loading