Skip to content

chore(ci): pin GitHub Actions SHAs to immutable commits#2664

Merged
ghiscoding merged 1 commit into
masterfrom
chore/action-shas
Jul 23, 2026
Merged

chore(ci): pin GitHub Actions SHAs to immutable commits#2664
ghiscoding merged 1 commit into
masterfrom
chore/action-shas

Conversation

@ghiscoding

@ghiscoding ghiscoding commented Jul 23, 2026

Copy link
Copy Markdown
Owner

Description

improve security by using SHAs to mitigate risks by using immutable commits instead of relying on tags that could be rewritten and point to different code in the future. Doing this change decreases risks of supply chain attacks.

Motivation and Context

For reference, here's the GitHub docs:

https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions

Pinning an action to a full-length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

@codecov

codecov Bot commented Jul 23, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.0%. Comparing base (e75ffea) to head (330a1e1).
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@           Coverage Diff           @@
##           master    #2664   +/-   ##
=======================================
  Coverage   100.0%   100.0%           
=======================================
  Files         200      200           
  Lines       25353    25353           
  Branches     8968     8968           
=======================================
  Hits        25353    25353           
Flag Coverage Δ
angular 100.0% <ø> (ø)
universal 100.0% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@pkg-pr-new

pkg-pr-new Bot commented Jul 23, 2026

Copy link
Copy Markdown
angular-slickgrid

npm i https://pkg.pr.new/angular-slickgrid@2664

aurelia-slickgrid

npm i https://pkg.pr.new/aurelia-slickgrid@2664

slickgrid-react

npm i https://pkg.pr.new/slickgrid-react@2664

slickgrid-vue

npm i https://pkg.pr.new/slickgrid-vue@2664

@slickgrid-universal/angular-row-detail-plugin

npm i https://pkg.pr.new/@slickgrid-universal/angular-row-detail-plugin@2664

@slickgrid-universal/aurelia-row-detail-plugin

npm i https://pkg.pr.new/@slickgrid-universal/aurelia-row-detail-plugin@2664

@slickgrid-universal/react-row-detail-plugin

npm i https://pkg.pr.new/@slickgrid-universal/react-row-detail-plugin@2664

@slickgrid-universal/vue-row-detail-plugin

npm i https://pkg.pr.new/@slickgrid-universal/vue-row-detail-plugin@2664

@slickgrid-universal/binding

npm i https://pkg.pr.new/@slickgrid-universal/binding@2664

@slickgrid-universal/common

npm i https://pkg.pr.new/@slickgrid-universal/common@2664

@slickgrid-universal/composite-editor-component

npm i https://pkg.pr.new/@slickgrid-universal/composite-editor-component@2664

@slickgrid-universal/custom-footer-component

npm i https://pkg.pr.new/@slickgrid-universal/custom-footer-component@2664

@slickgrid-universal/custom-tooltip-plugin

npm i https://pkg.pr.new/@slickgrid-universal/custom-tooltip-plugin@2664

@slickgrid-universal/empty-warning-component

npm i https://pkg.pr.new/@slickgrid-universal/empty-warning-component@2664

@slickgrid-universal/event-pub-sub

npm i https://pkg.pr.new/@slickgrid-universal/event-pub-sub@2664

@slickgrid-universal/excel-export

npm i https://pkg.pr.new/@slickgrid-universal/excel-export@2664

@slickgrid-universal/graphql

npm i https://pkg.pr.new/@slickgrid-universal/graphql@2664

@slickgrid-universal/odata

npm i https://pkg.pr.new/@slickgrid-universal/odata@2664

@slickgrid-universal/pagination-component

npm i https://pkg.pr.new/@slickgrid-universal/pagination-component@2664

@slickgrid-universal/pdf-export

npm i https://pkg.pr.new/@slickgrid-universal/pdf-export@2664

@slickgrid-universal/row-detail-view-plugin

npm i https://pkg.pr.new/@slickgrid-universal/row-detail-view-plugin@2664

@slickgrid-universal/rxjs-observable

npm i https://pkg.pr.new/@slickgrid-universal/rxjs-observable@2664

@slickgrid-universal/sql

npm i https://pkg.pr.new/@slickgrid-universal/sql@2664

@slickgrid-universal/text-export

npm i https://pkg.pr.new/@slickgrid-universal/text-export@2664

@slickgrid-universal/utils

npm i https://pkg.pr.new/@slickgrid-universal/utils@2664

@slickgrid-universal/vanilla-bundle

npm i https://pkg.pr.new/@slickgrid-universal/vanilla-bundle@2664

@slickgrid-universal/vanilla-force-bundle

npm i https://pkg.pr.new/@slickgrid-universal/vanilla-force-bundle@2664

@slickgrid-universal/web-mcp

npm i https://pkg.pr.new/@slickgrid-universal/web-mcp@2664

commit: 330a1e1

@ghiscoding
ghiscoding merged commit 35dedf2 into master Jul 23, 2026
15 checks passed
@ghiscoding
ghiscoding deleted the chore/action-shas branch July 23, 2026 20:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant