From 005a7b747f31bd8a80121447d699ed7cb2eebbc0 Mon Sep 17 00:00:00 2001 From: kobihikri Date: Tue, 14 Jul 2026 10:53:57 +0300 Subject: [PATCH] ci: pin ad-m/github-push-action to a full commit SHA MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The release-pr job passes GITHUB_TOKEN to ad-m/github-push-action, which is referenced by the mutable `@master` branch. A mutable ref means the exact code that runs with the token can change without any change in this repository. Pinning to a full commit SHA makes the action immutable while keeping the current behaviour. 881a6320fdb16eb5318c5054f31c218aec2b324c is the commit `@master` resolves to today, which is also tagged v1.3.0, so this changes nothing about what runs now — it just fixes the version in place. The trailing `# v1.3.0` comment keeps the human-readable version visible for future updates. This mirrors GitHub's own hardening guidance for third-party actions. --- .github/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index ec092acc2..7e30e8266 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -147,7 +147,7 @@ jobs: git config --local user.name "github-actions[bot]" git add . && git commit -m "release: v${GVA_VERSION##v}" - name: Push - uses: ad-m/github-push-action@master + uses: ad-m/github-push-action@881a6320fdb16eb5318c5054f31c218aec2b324c # v1.3.0 with: github_token: ${{ secrets.GITHUB_TOKEN }} branch: ${{ github.ref }}