🔒 Pin GitHub Actions to commit SHAs by paulinebm · Pull Request #36 · huggingface/responses.js

paulinebm · 2026-04-02T09:52:51Z

🔒 Pin GitHub Actions to commit SHAs

This PR pins all GitHub Actions to their exact commit SHA instead of mutable tags or branch names.

Why?
Pinning to a SHA prevents supply chain attacks where a tag (e.g. v4) could be moved to point to malicious code.

Workflow	Action	Avant	Après	SHA
`lint.yml`	`actions/checkout`	`v4`	`v6.0.2`	`de0fac2e4500…`
`lint.yml`	`actions/setup-node`	`v4`	`v4`	`49933ea5288c…`
`lint.yml`	`pnpm/action-setup`	`v4`	`v4`	`b906affcce14…`
`lint.yml`	`actions/cache`	`v4`	`v4`	`0057852bfaa8…`
`deploy.yml`	`actions/checkout`	`v4`	`v6.0.2`	`de0fac2e4500…`
`deploy.yml`	`docker/login-action`	`v3`	`v3`	`c94ce9fb4685…`
`deploy.yml`	`docker/metadata-action`	`v5`	`v5`	`c299e40c6544…`
`deploy.yml`	`docker/setup-buildx-action`	`v3`	`v3`	`8d2750c68a42…`
`deploy.yml`	`rlespinasse/github-slug-action`	`v4.5.0`	`v4.5.0`	`797d68864753…`
`deploy.yml`	`docker/build-push-action`	`v5`	`v5`	`ca052bb54ab0…`
`deploy.yml`	`rlespinasse/github-slug-action`	`v4.5.0`	`v4.5.0`	`797d68864753…`
`deploy.yml`	`aurelien-baudet/workflow-dispatch`	`v2`	`v2`	`93e95b157d79…`

🤖 Generated by /github-actions-audit — [security/pin-actions-to-sha]

Closes huggingface/tracking-issues#243

frac · 2026-04-04T07:23:27Z

I totally agree with you. The PR is failing on the linters check. So I think do a pnpm format and update it that it should be passing

paulinebm added 2 commits April 2, 2026 11:52

🔒 pin lint.yml actions to commit SHAs

8201723

🔒 pin deploy.yml actions to commit SHAs

7141940

paulinebm marked this pull request as ready for review April 2, 2026 12:19

paulinebm merged commit d1c1014 into main Apr 7, 2026
1 check failed

paulinebm deleted the security/pin-actions-to-sha branch April 7, 2026 13:26