Pin and modernize GitHub Actions references - #1891
Merged
Merged
Conversation
Actions under stripe/* are first-party and tracked on a branch on purpose, so requiring a commit hash for them would be churn without a security gain. Scoping the policy to that namespace keeps the blanket hash requirement in force for every third-party action. This lands before the pins so the auto-fixer honours the policy and leaves stripe/openapi/actions/* alone rather than hash-pinning them for a revert. Committed-By-Agent: claude
A tag is a mutable pointer, so any action referenced by tag can change what CI executes without a commit here. Pinning to a full commit hash makes the reference immutable and the version comment auditable. Thirteen of the fourteen pins came from the auto-fixer; every hash was then resolved against its claimed tag through the GitHub API before committing. pypa/gh-action-pypi-publish was pinned by hand because the auto-fixer cannot resolve a version for a branch reference. It tracked release/v1, whose head is currently tag v1.14.2, so the pin is both immutable and current. Dependabot would be the mechanism to keep it moving. Also sets persist-credentials: false on all three checkouts. The default leaves the workflow token in .git/config for the rest of the job, where any later step can read it; none of these jobs push, so nothing needs it retained. Committed-By-Agent: claude
Pinning froze these at the versions master happened to reference, and four of the five were on a Node runtime GitHub force-migrates, which every job warns about today: extractions/setup-just v2.0.0 -> v4.0.0 actions/checkout v3.7.0 -> v7.0.1 (node16 -> node24) actions/setup-python v4.9.1 -> v7.0.0 (node16 -> node24) actions/upload-artifact v4.6.2 -> v7.0.1 (node20 -> node24) actions/download-artifact v4.3.0 -> v8.0.1 (node20 -> node24) The artifact pair moves together on purpose: build uploads dist and publish downloads it, and upload v7 / download v8 are the majors upstream ships as a pair. download-artifact v5's breaking change is scoped to downloads by ID; this one downloads by name, so it does not apply. v8 skips decompression based on Content-Type, which only diverges when the uploader sets archive: false, and this workflow does not. setup-python's cache input has no default in v7, unlike setup-node's package-manager-cache from v5 onward, so the upgrade adds no cache surface to audit. v7 drops the pip-install input, which this workflow never set. All five majors require Actions runner 2.327.1 or later, which the GitHub-hosted runners this workflow uses already satisfy. Committed-By-Agent: claude
v8 fails the job on an artifact digest mismatch where v4 only logged a warning. The publish job is tag-gated, so CI never exercises it — the first person to see this failure will be mid-release, and the escape hatch should be next to the code rather than in a PR body. Committed-By-Agent: claude
Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com>
Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com>
Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com>
jar-stripe
enabled auto-merge (squash)
August 27, 2026 21:43
zacchua-stripe
approved these changes
Aug 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why?
Pins this repo's actions to commit hashes so a moved tag cannot change what CI runs, then brings the pinned versions current. Same approach as stripe/stripe-mock#1643.
What?
extractions/setup-just,actions/checkout,actions/setup-python,actions/upload-artifact,actions/download-artifact, andpypa/gh-action-pypi-publishto full commit hashes, each with its resolved version in a trailing commentpersist-credentials: falseon all three checkouts, so the token no longer stays in.git/configsetup-justv2 to v4,actions/checkoutv3 to v7.0.1,actions/setup-pythonv4 to v7.0.0,actions/upload-artifactv4 to v7.0.1, andactions/download-artifactv4 to v8.0.1. Every job on master warns today thatcheckout@v3,setup-python@v4,upload-artifact@v4, andsetup-just@v2are being force-migrated to a newer Node runtime; that warning is gone on this branch.github/zizmor.ymlwith aref-pinpolicy scoped to the stripe namespace, which keepsstripe/openapi/actions/*on@masterVerification.
zizmor 1.29.0over.github/workflows/: 15 reportable findings to zero — 12 highunpinned-uses, 3 mediumartipacked. Every hash was resolved against its claimed tag through the GitHub API, and zizmor'sref-version-mismatchaudit independently validates each version comment. CI is green on the branch across all 12 jobs, including windows and all three pypy versions, withPublishskipped as tag-gated; runs were dispatched manually becausejar/*branches are not in this workflow'spushtrigger list.See Also
unpinned-usesandartipacked: https://docs.zizmor.sh/audits/