Repository navigation
Pin GitHub Actions references to a full length commit SHA #1441
Description
Workflow files issue
Many GitHub Enterprises/Orgs require that all actions used in workflow files be pinned to a full-length commit SHA. The Squad workflow files are not pinned in this way, meaning that they have to be manually changed to be useable. Then when doing squad upgrade they have to be updated again.
Acceptance Criteria
- All Squad Workflow files in
.github/workflowsfolder have full-length commit SHA pins for all action uses.
Example
jobs:
heartbeat:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
Becomes
jobs:
heartbeat:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@4f1f4aec02e41874fa0262ea8ff5172d7978ad1e #v7
Activity
omercangumus commentedon Jul 3, 2026
picking this up. plan: resolve each action tag used across .github/workflows/*.yml to its full commit SHA via the GitHub API and rewrite the uses: lines to
owner/repo@<sha> # vX, keeping the version as a trailing comment for readability. scoped to the 19 files in .github/workflows, 10 unique actions total.ci: pin GitHub Actions references to full-length commit SHAs
ci: pin GitHub Actions references to full-length commit SHAs (github#…
chore: promote dev -> main (v0.12.0) (#1698)