From 0b7b46c536a25c91fb36fedd9e33b93e8ab0e446 Mon Sep 17 00:00:00 2001 From: LiukScot Date: Mon, 25 May 2026 09:22:25 +0200 Subject: [PATCH] chore(agents-md): require SHA-pin for third-party GitHub Actions Replaces the prior reactive policy ("pin to SHA only after a tag-moving incident") with a proactive one: third-party actions must be SHA-pinned with a `# vX.Y.Z` comment so Dependabot keeps bumping them. GitHub-owned actions (actions/*, github/*) may keep tags, with SHA pin preferred for defense-in-depth. Co-authored-by: Claude Opus 4.7 (1M context) --- AGENTS.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 005bfa0..534f99b 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -198,10 +198,13 @@ before any of the rules below. - Every workflow has a top-level `permissions:` block. Default to `contents: read`. Widen per-job only when needed. -- Track third-party actions at their latest stable tag (`@v4`). - Dependabot bumps the tag when a new major lands; review the - changelog and merge. Pin to SHA only when an action's repo has had - a tag-moving incident. +- All third-party GitHub Actions (anything not under `actions/*` or + `github/*`) must be pinned to a full commit SHA with a `# vX.Y.Z` + comment. The comment lets Dependabot keep bumping the SHA. SHA + pinning prevents a tag from being silently rewritten to a + malicious commit by a compromised maintainer account. +- GitHub-owned actions (`actions/*`, `github/*`): tag (`@v4`) is + acceptable; SHA pin preferred for defense-in-depth. - Never interpolate user-controlled input directly into `run:` blocks. Pipe through `env:`: