← Watch feed
Pin actions/checkout + actions/cache to a full URL and commit hash
Public commit record
73/100 · Adequate
What the developer wrote
Authored by Matt Corallo
Pin actions/checkout + actions/cache to a full URL and commit hash
Reference the checkout action by its explicit data.forgejo.org URL
pinned to a commit hash (v6) rather than the bare `actions/checkout@v4`
short form.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
What changed, and why it matters
This commit hardens the project's automated build and test scripts by replacing loose version tags like 'actions/checkout@v4' with exact commit hashes served from a specific domain. This prevents a compromised or renamed third-party action from silently injecting malicious code into the project's CI runs. It is a defensive security improvement, not a fix for an active bug or breach.
Recommended action
No immediate action required. Verify the pinned commit hashes match the intended upstream action releases and that data.forgejo.org is a trusted mirror. Consider applying the same pinning to any remaining unpinned actions and enabling automated dependency update tooling for pinned action SHAs.
Security signals we found
01
CI/CD supply-chain hardening
02
Action reference pinning to immutable commit hash
03
Use of explicit action mirror URL
04
No functional code or secret-handling changes
Evidence from the diff
The change pins Forgejo/GitHub Actions reusable actions (actions/checkout and actions/cache) to immutable commit hashes referenced via https://data.forgejo.org URLs. Previously the workflows used floating major-version tags (v4), which can be retargeted by the action publisher. Pinning to a full URL + SHA ensures the action content cannot change without modifying the workflow file, mitigating supply-chain risks in CI.
Changed components
.forgejo/workflows/audit.yml.forgejo/workflows/build.yml.forgejo/workflows/check_commits.yml.forgejo/workflows/check_unicode.yml.forgejo/workflows/ci-build.yml.forgejo/workflows/semver.ymlInspect captured patch +19 / −19
diff --git a/.forgejo/workflows/audit.yml b/.forgejo/workflows/audit.yml
index 45b083e..65d702e 100644
--- a/.forgejo/workflows/audit.yml
+++ b/.forgejo/workflows/audit.yml
@@ -9,7 +9,7 @@ jobs:
runs-on: debian-trixie
steps:
- name: Checkout source code
- uses: actions/checkout@v4
+ uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- name: Install Rust stable toolchain
run: |
rustup default stable
diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index d2013ea..7e0e518 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -17,7 +17,7 @@ jobs:
runs-on: debian-trixie
steps:
- name: Checkout source code
- uses: actions/checkout@v4
+ uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- name: Install Rust stable toolchain
run: |
rustup default stable
@@ -64,7 +64,7 @@ jobs:
runs-on: debian-trixie
steps:
- name: Checkout source code
- uses: actions/checkout@v4
+ uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
fetch-depth: 0
- name: Install Rust stable toolchain
@@ -108,13 +108,13 @@ jobs:
TOOLCHAIN: stable
steps:
- name: Checkout source code
- uses: actions/checkout@v4
+ uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- name: Install Rust ${{ env.TOOLCHAIN }} toolchain
run: |
rustup default ${{ env.TOOLCHAIN }}
- name: Cache routing graph snapshot
id: cache-graph
- uses: actions/cache@v4
+ uses: https://data.forgejo.org/actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
path: lightning/net_graph-2023-12-10.bin
key: ldk-net_graph-v0.0.118-2023-12-10.bin
@@ -131,7 +131,7 @@ jobs:
EXPECTED_ROUTING_GRAPH_SNAPSHOT_SHASUM: e94b38ef4b3ce683893bf6a3ee28d60cb37c73b059403ff77b7e7458157968c2
- name: Cache scorer snapshot
id: cache-scorer
- uses: actions/cache@v4
+ uses: https://data.forgejo.org/actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
path: lightning/scorer-2023-12-10.bin
key: ldk-scorer-v0.0.118-2023-12-10.bin
@@ -172,7 +172,7 @@ jobs:
TOOLCHAIN: stable
steps:
- name: Checkout source code
- uses: actions/checkout@v4
+ uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
fetch-depth: 0
- name: Install Rust ${{ env.TOOLCHAIN }} toolchain
@@ -203,7 +203,7 @@ jobs:
TOOLCHAIN: beta
steps:
- name: Checkout source code
- uses: actions/checkout@v4
+ uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
fetch-depth: 0
- name: Install Rust ${{ env.TOOLCHAIN }} toolchain
@@ -218,7 +218,7 @@ jobs:
TOOLCHAIN: 1.75
steps:
- name: Checkout source code
- uses: actions/checkout@v4
+ uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- name: Install Rust ${{ env.TOOLCHAIN }} toolchain
run: |
rustup default ${{ env.TOOLCHAIN }}
@@ -235,7 +235,7 @@ jobs:
TOOLCHAIN: 1.75
steps:
- name: Checkout source code
- uses: actions/checkout@v4
+ uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- name: Install Rust ${{ env.TOOLCHAIN }} toolchain
run: |
rustup default ${{ env.TOOLCHAIN }}
@@ -311,7 +311,7 @@ jobs:
TOOLCHAIN: stable
steps:
- name: Checkout source code
- uses: actions/checkout@v4
+ uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- name: Install Rust ${{ env.TOOLCHAIN }} toolchain
run: |
rustup default ${{ env.TOOLCHAIN }}
@@ -332,7 +332,7 @@ jobs:
TOOLCHAIN: 1.75.0
steps:
- name: Checkout source code
- uses: actions/checkout@v4
+ uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- name: Install Rust ${{ env.TOOLCHAIN }} toolchain
run: |
rustup default ${{ env.TOOLCHAIN }}
@@ -351,7 +351,7 @@ jobs:
TOOLCHAIN: 1.75.0
steps:
- name: Checkout source code
- uses: actions/checkout@v4
+ uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- name: Install Rust ${{ env.TOOLCHAIN }} toolchain
run: |
rustup default ${{ env.TOOLCHAIN }}
diff --git a/.forgejo/workflows/check_commits.yml b/.forgejo/workflows/check_commits.yml
index 969ebaf..8502bc2 100644
--- a/.forgejo/workflows/check_commits.yml
+++ b/.forgejo/workflows/check_commits.yml
@@ -16,7 +16,7 @@ jobs:
TOOLCHAIN: stable
steps:
- name: Checkout source code
- uses: actions/checkout@v4
+ uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
fetch-depth: 0
- name: Install Rust ${{ env.TOOLCHAIN }} toolchain
diff --git a/.forgejo/workflows/check_unicode.yml b/.forgejo/workflows/check_unicode.yml
index 2642696..e13c077 100644
--- a/.forgejo/workflows/check_unicode.yml
+++ b/.forgejo/workflows/check_unicode.yml
@@ -9,7 +9,7 @@ jobs:
runs-on: debian-trixie
steps:
- name: Checkout source code
- uses: actions/checkout@v4
+ uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- name: Configure fj credentials
# `fj` reads its token from keys.json; it has no token environment
# variable, so write the automatic Actions token there for the API call.
diff --git a/.forgejo/workflows/ci-build.yml b/.forgejo/workflows/ci-build.yml
index ec6f281..3f734c4 100644
--- a/.forgejo/workflows/ci-build.yml
+++ b/.forgejo/workflows/ci-build.yml
@@ -31,7 +31,7 @@ jobs:
runs-on: ${{ matrix.platform }}
steps:
- name: Checkout source code
- uses: actions/checkout@v4
+ uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- name: Install Rust ${{ matrix.toolchain }} toolchain
run: |
rustup default ${{ matrix.toolchain }}
@@ -49,14 +49,14 @@ jobs:
- name: Enable caching for bitcoind
if: matrix.platform != 'windows'
id: cache-bitcoind
- uses: actions/cache@v4
+ uses: https://data.forgejo.org/actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
path: bin/bitcoind-${{ runner.os }}-${{ runner.arch }}
key: bitcoind-${{ runner.os }}-${{ runner.arch }}
- name: Enable caching for electrs
if: matrix.platform != 'windows'
id: cache-electrs
- uses: actions/cache@v4
+ uses: https://data.forgejo.org/actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
path: bin/electrs-${{ runner.os }}-${{ runner.arch }}
key: electrs-${{ runner.os }}-${{ runner.arch }}
diff --git a/.forgejo/workflows/semver.yml b/.forgejo/workflows/semver.yml
index 479517d..3322de8 100644
--- a/.forgejo/workflows/semver.yml
+++ b/.forgejo/workflows/semver.yml
@@ -12,7 +12,7 @@ jobs:
runs-on: debian-trixie
steps:
- name: Checkout source code
- uses: actions/checkout@v4
+ uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
fetch-depth: 0
- name: Install Rust stable toolchain
Risk score
Our methodology →Why this scored 18/100
Human-validated context
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
No validated notes yet.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.