Repository navigation
CI: Hash-pin all actions #146488
Description
Activity
- added a commit that references this issue
on Apr 1, 2026 Backporting this to 3.10-14 is going to be gnarly, so I'm going to manually do the equivalent. Tracking:
- 3.10: [3.10] gh-146488: hash-pin all action references (gh-146489) #147978
- 3.11: [3.11] gh-146488: hash-pin all action references (gh-146489) #147979
- 3.12: [3.12] gh-146488: hash-pin all action references (gh-146489) #147980
- 3.13: [3.13] gh-146488: hash-pin all action references (gh-146489) #147981
- 3.14: [3.14] gh-146488: hash-pin all action references (gh-146489) #147983
- added 5 commits that reference this issue
on Apr 1, 2026 This is fully done and backported. Thanks a ton @sethmlarson and @hugovk!
Reacted by Seth Larson and Hugo van KemenadeI've just enabled this setting at https://github.com/python/cpython/settings/actions:
- Require actions to be pinned to a full-length commit SHA
I've just enabled this setting at python/cpython/settings/actions:
FYI that might cause breakage, since GitHub enforces that transitively. So if any of CPython's action dependencies have transitive dependencies that are themselves unpinned, you'll see a pretty opaque job startup failure error.
(OTOH you might get lucky! The actions ecosystem is doing a way better job with pinning now than it was a few months ago.)
Thanks for the warning! I've disabled it then, can try it another time when it's not so late here, and will share/warn more widely.
I've turned it on in my branch and see how that gets on.
And we have Zizmor anyway in the newer branches :)
Reacted by William WoodruffI've turned it on in my branch and see how that gets on.
We found one that breaks in hugovk#81:
Download action repository 'readthedocs/actions@b8bba1484329bda1a3abe986df7ebc80a8950333' (SHA:b8bba1484329bda1a3abe986df7ebc80a8950333) Getting action download info Error: The actions actions/checkout@v3 and actions/github-script@v6 are not allowed in hugovk/cpython because all actions must be pinned to a full-length commit SHA.https://github.com/hugovk/cpython/actions/runs/24580183435/job/71875718404?pr=81
But https://github.com/readthedocs/actions is deprecated and we're planning on getting rid of it: python/core-workflow#587.
(Sorry for using a blank issue for this! None of the other templates seemed exactly right.)
I'm proposing that CPython's CI switch to fully-hash-pinned GitHub Actions references. This is enforced by default via zizmor, but currently CPython's configuration relaxes that default here:
cpython/.github/zizmor.yml
Line 10 in 17070f4
Doing so should be a non-breaking change: the versions resolved will be the same as before, and tools like Dependabot/Renovate/pinact will continue to be able to update any action references, including their hashes.
Ref: https://docs.zizmor.sh/audits/#unpinned-uses
CC @sethmlarson
Linked PRs
reusable-check-html-ids.ymlworkflow #147975