September 20, 2026 路 #4
The action that moved overnight
This workflow checks out the repo and runs tests. What is the supply-chain problem?
name: test
on:
push:
branches: [main]
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- run: npm ci
- run: npm testNext puzzle in UTC
One try. The first answer sticks.
How to fix it
A tag such as v4 can be moved. Pin actions/checkout to a full 40-character commit SHA and let Dependabot bump it.
actions/checkout@v4 looks pinned. It is not. GitHub tags are mutable. The owner of the action, or someone who compromises that repository, can move v4 to a new commit and your next build runs that code with the permissions of GITHUB_TOKEN.
A full commit SHA is immutable. Dependabot and Renovate both know how to open pull requests that bump SHAs while keeping the version comment readable.
Fix
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
Use the current SHA from the release you intend, not this example if it has gone stale. Turn on Dependabot's package-ecosystem: github-actions so the pin does not rot. For actions outside actions/ and your own org, SHA pinning is the minimum bar, not a nice-to-have.