From d088984133b673c142b313e9dbd59b57e0dbc170 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 2 Nov 2026 08:36:27 +0000 Subject: [PATCH] ci: pin all GitHub Actions to full commit SHAs Pin every `uses:` reference in .github/workflows to the commit SHA of the latest release within the major version already in use, with the tag in a trailing comment. Resolves Codacy's two "Enforce Pinning of Third-Party GitHub Actions to Full Commit SHA" issues in draft-release.yml. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_016QZq4r8oBXkUEKp5sPvoXV --- .github/workflows/deploy-wporg.yml | 2 +- .github/workflows/draft-release.yml | 6 +++--- .github/workflows/tests.yml | 16 ++++++++-------- .github/workflows/update-wporg-assets.yml | 2 +- 4 files changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/deploy-wporg.yml b/.github/workflows/deploy-wporg.yml index eddb6f0..05d9f54 100644 --- a/.github/workflows/deploy-wporg.yml +++ b/.github/workflows/deploy-wporg.yml @@ -14,7 +14,7 @@ jobs: runs-on: ubuntu-latest environment: wordpress-org steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # WordPress.org serves the version named by readme.txt's Stable tag, so a mismatch would publish the # wrong code or none at all. diff --git a/.github/workflows/draft-release.yml b/.github/workflows/draft-release.yml index bf6ff74..8696d9a 100644 --- a/.github/workflows/draft-release.yml +++ b/.github/workflows/draft-release.yml @@ -14,14 +14,14 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Get tag version id: get_tag run: echo "TAG_NAME=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV - name: Set up PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: "8.1" @@ -34,7 +34,7 @@ jobs: run: composer check-zip - name: Create GitHub Release (draft) and upload zip - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 with: tag_name: ${{ env.TAG_NAME }} name: Release ${{ env.TAG_NAME }} diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index ee3dd46..2920b66 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -23,7 +23,7 @@ jobs: # The plugin declares PHP >= 7.2, so check syntax down to that. php: ["7.2", "7.4", "8.0", "8.1", "8.2", "8.3", "8.4"] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: @@ -38,7 +38,7 @@ jobs: name: Coding standards runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: @@ -55,7 +55,7 @@ jobs: name: Plugin Check runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Check what ships (the git archive, as in the release zip and WordPress.org SVN), not the dev files. - name: Export plugin files @@ -105,7 +105,7 @@ jobs: WP_TESTS_DB_PASSWORD: root WP_TESTS_DB_NAME: wordpress_test steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: @@ -132,7 +132,7 @@ jobs: - name: Upload coverage report if: ${{ matrix.coverage }} - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: php-coverage path: coverage.xml @@ -141,9 +141,9 @@ jobs: name: Jest runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@v7 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "22" cache: npm @@ -156,7 +156,7 @@ jobs: name: Release zip contents runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: diff --git a/.github/workflows/update-wporg-assets.yml b/.github/workflows/update-wporg-assets.yml index 3dd111a..548bf99 100644 --- a/.github/workflows/update-wporg-assets.yml +++ b/.github/workflows/update-wporg-assets.yml @@ -13,7 +13,7 @@ jobs: runs-on: ubuntu-latest environment: wordpress-org steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Update WordPress.org SVN assets uses: 10up/action-wordpress-plugin-asset-update@2480306f6f693672726d08b5917ea114cb2825f7 # 2.2.0