From 46fab801f90a0376de77727ed064bfa9ced8fa77 Mon Sep 17 00:00:00 2001 From: codeopsai-bot Date: Sun, 21 Jun 2026 20:42:08 +0530 Subject: [PATCH] Pin third-party actions to commit SHAs This PR addresses 3 workflow findings: - [low] unpinned-action in .github/workflows/cdn.yml: Unpinned action version: actions/checkout@v2 - [low] unpinned-action in .github/workflows/cdn.yml: Unpinned action version: actions/setup-node@v2 - [medium] unpinned-action in .github/workflows/cdn.yml: Unpinned action version: antfu/gha-publish-to-git@master These workflows handle CI/CD with elevated privileges; the affected configurations expand attack surface or grant tokens broader access than needed. See the PR description for per-finding rationale and citations. --- .github/workflows/cdn.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/cdn.yml b/.github/workflows/cdn.yml index c242e43f..f97e2397 100644 --- a/.github/workflows/cdn.yml +++ b/.github/workflows/cdn.yml @@ -12,15 +12,15 @@ jobs: matrix: node-version: [ 16 ] steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v2 + uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 with: node-version: ${{ matrix.node-version }} registry-url: https://registry.npmjs.org/ - run: npm ci - run: npm run build:site - - uses: antfu/gha-publish-to-git@master + - uses: antfu/gha-publish-to-git@528b85e1d7b83e8a9ef32a1f93f909bc7b93bfc7 with: branch: cdn github_token: '${{ secrets.GITHUB_TOKEN }}'