2akouwu opened a new pull request, #39917: URL: https://github.com/apache/beam/pull/39917
## What Pins the third-party GitHub Actions used in `IO_Iceberg_Unit_Tests.yml` to their exact commit SHA instead of a mutable version tag: - `actions/checkout@v7` → `@3d3c42e...` (`# v7`) - `actions/upload-artifact@v7` (both usages) → `@043fb46...` (`# v7`) - `EnricoMi/publish-unit-test-result-action@v2` → `@d0a4676...` (`# v2`) - `jwgmeligmeyling/[email protected]` → `@b8e2c35...` (`# v1.2`) ## Why A tag like `@v7` can be moved to point at different code after the fact (by the action's own maintainer, or if their account/repo is compromised), so a workflow pinned only to a tag can silently start running different code than what was reviewed when the workflow was written. Pinning to a full commit SHA (keeping the version as a trailing comment for readability) is the mitigation GitHub's own Actions security hardening guide and OpenSSF Scorecard's `Pinned-Dependencies` check both recommend. This only touches the one workflow file that had unpinned references; the local composite actions under `./.github/actions/...` are untouched since they aren't external and don't carry this risk. ## Testing This is a CI-workflow-only change with no code path to unit test. I verified each SHA by resolving the exact commit each tag currently points to via the GitHub API (`git/refs/tags/...`, dereferencing the annotated tag object for `EnricoMi/publish-unit-test-result-action`), and confirmed the file is still valid YAML. The real verification is that the workflow keeps running identically on its next trigger, since each SHA is exactly the commit its tag currently resolves to. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
