From 906dde71066ef3f72dd7a97644a11ecb2b54cf8d Mon Sep 17 00:00:00 2001 From: Yuuki Takano Date: Fri, 16 Oct 2026 18:18:15 +0900 Subject: [PATCH 1/2] ci: pin actions/checkout to a full commit SHA Replace the mutable `actions/checkout@v3` tag with the immutable commit SHA for v3.7.0 (a37ce9120846195fa4ece8f58b268e6043cb2f26). Tags can be moved or overwritten, so pinning to a SHA guards the workflow against supply-chain tampering of the action and makes CI runs reproducible. The version is kept as a trailing comment so Dependabot/Renovate can still track and propose updates. Co-Authored-By: Claude Fable 5.1 Signed-off-by: Yuuki Takano --- .github/workflows/rust.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index 88c902889..328ffbb5a 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -16,7 +16,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Install Rust nightly run: rustup toolchain install nightly-2026-07-20 From 090190275cf59ab17bf9093e514e4ed5ffae80d3 Mon Sep 17 00:00:00 2001 From: Yuuki Takano Date: Fri, 16 Oct 2026 18:26:59 +0900 Subject: [PATCH 2/2] ci: pin technote-space/assign-author to a full commit SHA Replace the mutable `@v1` tag reference in auto-assign.yaml with the full commit SHA (9558557c5c4816f38bd06176fbc324ba14bb3160), keeping a `# v1` comment for readability. Pinning to an immutable SHA prevents a compromised or force-pushed tag from silently changing the action code that runs in CI, following the same hardening applied to actions/checkout. Co-Authored-By: Claude Fable 5.1 Signed-off-by: Yuuki Takano --- .github/workflows/auto-assign.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/auto-assign.yaml b/.github/workflows/auto-assign.yaml index 652eaebe4..3f351b83d 100644 --- a/.github/workflows/auto-assign.yaml +++ b/.github/workflows/auto-assign.yaml @@ -9,4 +9,4 @@ jobs: runs-on: ubuntu-22.04 steps: - name: Assign author to assignee on PR - uses: technote-space/assign-author@v1 + uses: technote-space/assign-author@9558557c5c4816f38bd06176fbc324ba14bb3160 # v1