Repository navigation
Update all github workflow to use actions tied to sha hashes #15298
Description
Activity
I think this is a good first issue as the write up is clear and there is an example to follow
take
Hi there,
I just checked this issue and tried to solved it.
Feel free for feedback.
Thank You.
A recent supply chain attack has made it extremely apparent that github workflows should only use actions that are tied to a specific hash, not a version. This applies to any non-github, non-apache action of which there seems to be a few:
This is very important.
I don't understand why Github actions copied design from Docker world, where a version string is not a version 😞Do you know if there is any automation to lint workflows for mutable-version-ref actions?
Even if we solve this problem today (which we should!), automation could help us not get back to a bad state.Do you maybe know if an action can be composite and reference downstream actions, potentially with mutable-version-ref? Is there an equivalent of Cargo.lock / package-lock.json for workflows? (i doubt but ...)
Do you know if there is any automation to lint workflows for mutable-version-ref actions?
I do now know of any myself
I think we have basically done this , eg
datafusion/.github/workflows/rust.yml
Line 58 in ed836d7
Let's close this one now and we can reopen if there is more work to be done
- added a commit that references this issue
on Jun 22, 2026
Is your feature request related to a problem or challenge?
A recent supply chain attack has made it extremely apparent that github workflows should only use actions that are tied to a specific hash, not a version. This applies to any non-github, non-apache action of which there seems to be a few:
an example of how to use a sha hash instead of a version can be seen in the extended.yml file:
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1beDescribe the solution you'd like
No response
Describe alternatives you've considered
No response
Additional context
No response