CI: Hash-pin all actions

@sethmlarson

(Sorry for using a blank issue for this! None of the other templates seemed exactly right.)

I'm proposing that CPython's CI switch to fully-hash-pinned GitHub Actions references. This is enforced by default via zizmor, but currently CPython's configuration relaxes that default here:

cpython/.github/zizmor.yml

Line 10 in 17070f4

"*": ref-pin

Doing so should be a non-breaking change: the versions resolved will be the same as before, and tools like Dependabot/Renovate/pinact will continue to be able to update any action references, including their hashes.

Ref: https://docs.zizmor.sh/audits/#unpinned-uses

CC @sethmlarson

Linked PRs

gh-146488: hash-pin all action references

gh-146488: hash-pin check-html-ids action references (#147968)

pythongh-146488: find correct merge base in check-html-ids

Backporting this to 3.10-14 is going to be gnarly, so I'm going to manually do the equivalent. Tracking:

pythongh-146488: hash-pin all action references

[3.13] gh-146488: hash-pin all action references (gh-146489) (#147981)

[3.11] gh-146488: hash-pin all action references (gh-146489) (#147979)

[3.10] gh-146488: hash-pin all action references (gh-146489) (#147978)

[3.14] gh-146488: hash-pin all action references (gh-146489) (#147983)

[3.12] pythongh-146488: hash-pin all action references (pythongh-146489)

[3.12] gh-146488: hash-pin all action references (gh-146489) (#147980)

@sethmlarson

This is fully done and backported. Thanks a ton @sethmlarson and @hugovk!

I've just enabled this setting at https://github.com/python/cpython/settings/actions:

Require actions to be pinned to a full-length commit SHA

I've just enabled this setting at python/cpython/settings/actions:

FYI that might cause breakage, since GitHub enforces that transitively. So if any of CPython's action dependencies have transitive dependencies that are themselves unpinned, you'll see a pretty opaque job startup failure error.

(OTOH you might get lucky! The actions ecosystem is doing a way better job with pinning now than it was a few months ago.)

Thanks for the warning! I've disabled it then, can try it another time when it's not so late here, and will share/warn more widely.

I've turned it on in my branch and see how that gets on.

And we have Zizmor anyway in the newer branches :)

pythongh-146488: hash-pin all action references

pythongh-146488: hash-pin check-html-ids action references (python#14…

I've turned it on in my branch and see how that gets on.

We found one that breaks in hugovk#81:

Download action repository 'readthedocs/actions@b8bba1484329bda1a3abe986df7ebc80a8950333' (SHA:b8bba1484329bda1a3abe986df7ebc80a8950333)
Getting action download info
Error: The actions actions/checkout@v3 and actions/github-script@v6 are not allowed in hugovk/cpython because all actions must be pinned to a full-length commit SHA.

https://github.com/hugovk/cpython/actions/runs/24580183435/job/71875718404?pr=81

But https://github.com/readthedocs/actions is deprecated and we're planning on getting rid of it: python/core-workflow#587.

pythongh-146488: hash-pin all action references

pythongh-146488: hash-pin check-html-ids action references (python#14…

Navigation Menu

Repository navigation

CI: Hash-pin all actions #146488

Linked PRs

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

CI: Hash-pin all actions #146488

Description

Linked PRs

Activity

woodruffw commented on Apr 1, 2026

woodruffw commented on Apr 2, 2026

hugovk commented on Apr 8, 2026

woodruffw commented on Apr 8, 2026

hugovk commented on Apr 8, 2026

hugovk commented on Apr 17, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions