ci: pin all workflow actions to commit SHAs by ndycode · Pull Request #519 · ndycode/codex-multi-auth

ndycode · 2026-06-09T17:45:25Z

Summary

Part 3 of the repo-wide audit (#517, #518). ci.yml, pr-ci.yml, and codeql.yml referenced actions by mutable tags while codex-plugin-scanner.yml already used SHA pins — an inconsistent supply-chain posture. A mutable tag can be re-pointed if the upstream action repo is compromised (as happened with tj-actions/changed-files in 2025), which would execute attacker code with access to the CI environment.

Changes

Every uses: reference is now pinned to a full commit SHA with the tag noted inline, matching the convention codex-plugin-scanner.yml already established:

Action	Pin	Provenance
`actions/checkout@v4`	`34e11487…14f8d5`	same SHA already trusted in `codex-plugin-scanner.yml`
`actions/setup-node@v4`	`49933ea5…820020`	verified against the `v4` tag on github.com/actions/setup-node
`github/codeql-action/{init,autobuild,analyze}@v3`	`dd903d2e…32357`	`v3` → v3.36.2 tag on github.com/github/codeql-action

No workflow logic changes — pin-only diff.

Maintenance: .github/dependabot.yml already has a github-actions ecosystem entry, so Dependabot will keep these SHA pins updated (it understands the # vN comment convention).

Testing

YAML untouched apart from the uses: lines; grep confirms zero unpinned uses: references remain across all four workflows. CI on this PR itself exercises the pinned checkout/setup-node paths.

https://claude.ai/code/session_01XNtnkLbBiXZxfQQYLMpucB

Generated by Claude Code

note: greptile review for oc-chatgpt-multi-auth. cite files like `lib/foo.ts:123`. confirm regression tests + windows concurrency/token redaction coverage.

Greptile Summary

pin-only supply-chain hardening across ci.yml, pr-ci.yml, and codeql.yml, replacing mutable action tags with full commit SHAs and aligning all four workflow files to the same pinning convention already established in codex-plugin-scanner.yml. codeql-action is also silently upgraded from v3 to v4 in the process, addressing the deprecation flagged in a prior review thread.

ci.yml / pr-ci.yml: five jobs each now pin actions/checkout and actions/setup-node to the same SHAs used in the trusted codex-plugin-scanner.yml baseline.
codeql.yml: init, autobuild, and analyze all pinned to 8aad20d1…1e # v4 — consistent single SHA across the three sub-actions; includes a quiet major-version bump from v3 to v4.
no workflow logic, triggers, permissions, or step ordering changed — pure uses: line replacements throughout.

Confidence Score: 5/5

safe to merge — pure uses: line replacements with no logic, trigger, or permission changes

every changed line is a tag-to-SHA substitution; the checkout SHA matches the trusted baseline already in codex-plugin-scanner.yml, the codeql-action upgrade to v4 is a straightforward major-version bump with no breaking changes for javascript-typescript analysis, and dependabot is already configured to keep these pins current

no files require special attention

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	all five jobs now pin checkout and setup-node to full commit SHAs; no logic changes
.github/workflows/pr-ci.yml	three jobs updated with same SHA pins as ci.yml; validate, node22-smoke, scripts-windows all consistent
.github/workflows/codeql.yml	checkout pinned; codeql init/autobuild/analyze pinned to v4 SHA (silently upgraded from v3, addressing prior review feedback)

_{Reviews (2): Last reviewed commit: "ci: move codeql-action pin from deprecat..." | Re-trigger Greptile}

@V3

ci.yml, pr-ci.yml, and codeql.yml referenced actions by mutable tags (actions/checkout@v4, actions/setup-node@v4, github/codeql-action@v3) while codex-plugin-scanner.yml already used SHA pins. A mutable tag can be re-pointed if the action repo is compromised, so tag references leave the release pipeline exposed to upstream supply-chain attacks. Pin every action to its full commit SHA with the tag noted inline, matching the convention codex-plugin-scanner.yml already established: - actions/checkout@v4 -> 34e114876b0b11c390a56381ad16ebd13914f8d5 (same pin already trusted in codex-plugin-scanner.yml) - actions/setup-node@v4 -> 49933ea5288caeca8642d1e84afbd3f7d6820020 - github/codeql-action/*@V3 -> dd903d2e4f5405488e5ef1422510ee31c8b32357 (v3.36.2) Dependabot's github-actions ecosystem entry keeps these pins updated. https://claude.ai/code/session_01XNtnkLbBiXZxfQQYLMpucB

chatgpt-codex-connector · 2026-06-09T17:45:31Z

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

coderabbitai · 2026-06-09T17:45:33Z

Warning

Review limit reached

@ndycode, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 28 minutes and 36 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: f2a1e09f-e3de-473b-ab31-40c178ad0c2a

📥 Commits

Reviewing files that changed from the base of the PR and between 98d9819 and 1137597.

📒 Files selected for processing (3)

.github/workflows/ci.yml
.github/workflows/codeql.yml
.github/workflows/pr-ci.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch claude/audit-03-ci-action-pinning

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch claude/audit-03-ci-action-pinning

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai · 2026-06-09T17:45:49Z

Warning

Review limit reached

@ndycode, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 27 minutes and 40 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: eb2a0de9-5b01-403b-8dd9-c29c588fae9f

📥 Commits

Reviewing files that changed from the base of the PR and between 98d9819 and 9b35abf.

📒 Files selected for processing (3)

.github/workflows/ci.yml
.github/workflows/codeql.yml
.github/workflows/pr-ci.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch claude/audit-03-ci-action-pinning

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch claude/audit-03-ci-action-pinning

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Review follow-up on the SHA-pinning change: codeql-action v3 is deprecated in favor of v4, so pin init/autobuild/analyze to the v4 tag SHA (8aad20d150bbac5944a9f9d289da16a4b0d87c1e = v4.36.2) instead of keeping the v3 line that will stop receiving security updates. https://claude.ai/code/session_01XNtnkLbBiXZxfQQYLMpucB

Audit roadmap §4.4.1: merge .github/workflows/pr-ci.yml into ci.yml so a single workflow runs on push to main and on pull requests, removing the duplicated job definitions. Consolidation details: - ci.yml now triggers on both push (main) and pull_request (main); the concurrency group keys on the PR number (falling back to ref) so PR runs and push runs never cancel each other. - The test matrix (Node 20.x/22.x), lint, release-harness, scripts-windows, and codex-compat jobs are unchanged and now also run on PRs. - The PR-only coverage-threshold gate is preserved as the `validate` ("PR Validation") job, gated with `if: github.event_name == 'pull_request'`. - pr-ci.yml's `node22-smoke` ("Node 22 Smoke") job is dropped: every one of its steps (typecheck, tests, audit:ci, build) is subsumed by the 22.x leg of the test matrix, which now runs on PRs. Branch protection contexts referencing "PR CI / *" or "Node 22 Smoke" need updating to "CI / *". Closes ndycode#523: add a Node 18 runtime smoke pipeline validating the engines floor (node >=18): - `build-package` (Node 20): npm ci, build, npm pack, upload the tarball artifact (actions/upload-artifact pinned to v4.6.2 SHA). - `node18-smoke` (Node 18.17.x, needs build-package): download the tarball (actions/download-artifact pinned to v4.3.0 SHA), `npm install -g` it with no checkout and no devDependencies, then smoke-run `codex-multi-auth --version` and `codex-multi-auth --help`. test/ci-workflows.test.ts updated to assert the consolidated layout (pr-ci.yml absent, PR coverage gate, Windows parity, Node 18 smoke design). Stacked on the action-pinning branch (PR ndycode#519) since both touch every `uses:` line in these workflows; this commit reuses its pinned SHAs. https://claude.ai/code/session_01XNtnkLbBiXZxfQQYLMpucB

ndycode mentioned this pull request Jun 9, 2026

docs: fix stale command names, version drift, and duplicate doc-portal rows #520

Merged

greptile-apps Bot reviewed Jun 9, 2026

View reviewed changes

Comment thread .github/workflows/codeql.yml Outdated

ndycode mentioned this pull request Jun 10, 2026

chore(hooks): run typecheck in pre-commit, drop deprecated husky bootstrap #521

Merged

coderabbitai Bot approved these changes Jun 10, 2026

View reviewed changes

This was referenced Jun 10, 2026

docs(audit): 2026-06-10 repository architecture & best-practices audit #522

Merged

ci: consolidate ci and pr-ci workflows; add Node 18 runtime smoke job #531

Merged

ndycode merged commit 848238b into main Jun 10, 2026
2 checks passed

Navigation Menu

ci: pin all workflow actions to commit SHAs - #519

ci: pin all workflow actions to commit SHAs#519
ndycode merged 2 commits into
mainfrom
claude/audit-03-ci-action-pinning

ndycode commented Jun 9, 2026 •

edited by greptile-apps Bot

Loading

Uh oh!

chatgpt-codex-connector Bot commented Jun 9, 2026

Uh oh!

coderabbitai Bot commented Jun 9, 2026 •

edited

Loading

Review limit reached

Uh oh!

coderabbitai Bot commented Jun 9, 2026

Review limit reached

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ndycode commented Jun 9, 2026 • edited by greptile-apps Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Testing

note: greptile review for oc-chatgpt-multi-auth. cite files like lib/foo.ts:123. confirm regression tests + windows concurrency/token redaction coverage.

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

chatgpt-codex-connector Bot commented Jun 9, 2026

Uh oh!

coderabbitai Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

coderabbitai Bot commented Jun 9, 2026

Review limit reached

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ndycode commented Jun 9, 2026 •

edited by greptile-apps Bot

Loading

note: greptile review for oc-chatgpt-multi-auth. cite files like `lib/foo.ts:123`. confirm regression tests + windows concurrency/token redaction coverage.

coderabbitai Bot commented Jun 9, 2026 •

edited

Loading