Repository navigation
ci: pin actions in squad-insider-release.yml template to commit SHAs #1462
Description
Follow-up from #1442. The squad-insider-release.yml template was left out of the SHA pinning work under a documented waiver, so its action references are still tag-based.
Once the waiver is no longer needed, the actions in this template should be pinned to full-length commit SHAs like the rest of the workflows, with trailing version comments for readability. Dependabot is already set up for weekly SHA maintenance, so it will pick this file up once pinned.
Activity
docs: production security hardening — threat model, prompt injection …
bradygaster commentedon Aug 23, 2026
Triage note — this is NOT fixed. Flagging because it was nearly closed as shipped.
#1442 (
security(ci): pin third-party GitHub Actions to full commit SHAs) pinned the actions in.github/workflows/— the repo's own CI. For example.github/workflows/squad-insider-publish.ymlis now correctly onactions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1.It did not touch the shipped templates. All four copies still use floating tags:
checkoutsetup-node.squad-templates/workflows/squad-insider-release.yml@v4@v4templates/workflows/squad-insider-release.yml@v4@v4packages/squad-cli/templates/workflows/squad-insider-release.yml@v4@v4packages/squad-sdk/templates/workflows/squad-insider-release.yml@v4@v4These are the files
squad initwrites into consumer repos. So the unpinned-action exposure was removed from our repo and left in place for every downstream user — which is the worse half, since those repos inherit the risk without having chosen it.Two things this suggests beyond the original scope:
.github/workflows/pinned should cover**/templates/**/*.ymltoo, or this re-diverges on the next template edit.Verified against
origin/devon 2026-08-23.