From 9664b23b6af203e64bef4c11fbf7f6e20bed5e87 Mon Sep 17 00:00:00 2001 From: jaydestro <2974195+jaydestro@users.noreply.github.com> Date: Fri, 30 Oct 2026 01:17:05 +0000 Subject: [PATCH] Pin CI actions to full-length commit SHAs Pin checkout, setup-python, and upload-artifact to verified v7 commits and align documentation with the SHA-pinning policy. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/copilot-instructions.md | 3 ++- .github/workflows/agentic-ci.yml | 24 ++++++++++++------------ .github/workflows/azure-cd-example.yml | 4 ++-- .github/workflows/emulator-ci.yml | 12 ++++++------ README.md | 3 ++- 5 files changed, 24 insertions(+), 22 deletions(-) diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md index 569822e..6856b5d 100644 --- a/.github/copilot-instructions.md +++ b/.github/copilot-instructions.md @@ -67,7 +67,8 @@ enough to explain alongside the CI workflow. - Verify the contributor's intended repository and authenticated identity before remote operations. Never embed a maintainer's account, token or machine path. -- Actions uses `pull_request`, supported action release tags and `contents: read`. Do not execute +- Actions uses `pull_request` and `contents: read`. Pin checkout, Python setup and + artifact upload to full-length commit SHAs with release-version comments. Do not execute untrusted PR code through `pull_request_target` or add personal tokens. - Emulator tests require no Azure credentials. Its public SDK test key does not prove authentication; the emulator does not enforce authorization. diff --git a/.github/workflows/agentic-ci.yml b/.github/workflows/agentic-ci.yml index ec4a702..06080c9 100644 --- a/.github/workflows/agentic-ci.yml +++ b/.github/workflows/agentic-ci.yml @@ -31,11 +31,11 @@ jobs: PIP_DISABLE_PIP_VERSION_CHECK: "1" steps: - name: Check out the tested revision - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - name: Set up Python 3.12 - uses: actions/setup-python@v7 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: python-version: "3.12" - name: Install uv 0.13.0 from Microsoft @@ -47,7 +47,7 @@ jobs: run: uv run --locked --extra test python -m scripts.agent_ci --task ${{ matrix.task }} - name: Preserve task results and diagnostics if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: agent-task-${{ matrix.task }}-${{ github.run_attempt }} path: .artifacts/agent-ci/ @@ -71,11 +71,11 @@ jobs: PIP_DISABLE_PIP_VERSION_CHECK: "1" steps: - name: Check out the trusted default-branch revision - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - name: Set up Python 3.12 - uses: actions/setup-python@v7 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: python-version: "3.12" - name: Set up Node.js 24 @@ -101,7 +101,7 @@ jobs: --agent-command 'copilot -p "{prompt}" -s --allow-all-tools --no-ask-user --disable-builtin-mcps --no-custom-instructions --secret-env-vars=GITHUB_TOKEN --max-ai-credits 30' - name: Preserve real-agent patches, test results and diagnostics if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: copilot-swarm-${{ github.run_attempt }} path: .artifacts/agent-swarm/ @@ -118,11 +118,11 @@ jobs: PIP_DISABLE_PIP_VERSION_CHECK: "1" steps: - name: Check out the tested revision - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - name: Set up Python 3.12 - uses: actions/setup-python@v7 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: python-version: "3.12" - name: Install uv 0.13.0 from Microsoft @@ -134,7 +134,7 @@ jobs: run: uv run --locked --extra test python -m scripts.agent_isolation - name: Preserve isolation results and diagnostics if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: agent-isolation-${{ github.run_attempt }} path: .artifacts/agent-isolation/ @@ -152,11 +152,11 @@ jobs: PIP_DISABLE_PIP_VERSION_CHECK: "1" steps: - name: Check out the tested revision - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - name: Set up Python 3.12 - uses: actions/setup-python@v7 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: python-version: "3.12" - name: Install uv 0.13.0 from Microsoft @@ -168,7 +168,7 @@ jobs: run: uv run --locked --extra test python -m scripts.agent_swarm - name: Preserve swarm results and diagnostics if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: agent-swarm-${{ github.run_attempt }} path: .artifacts/agent-swarm/ diff --git a/.github/workflows/azure-cd-example.yml b/.github/workflows/azure-cd-example.yml index 1949eb0..1701f88 100644 --- a/.github/workflows/azure-cd-example.yml +++ b/.github/workflows/azure-cd-example.yml @@ -74,7 +74,7 @@ jobs: id-token: write steps: - name: Check out the selected revision - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false @@ -107,7 +107,7 @@ jobs: done - name: Set up Python 3.12 - uses: actions/setup-python@v7 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: python-version: "3.12" diff --git a/.github/workflows/emulator-ci.yml b/.github/workflows/emulator-ci.yml index c448275..88a903a 100644 --- a/.github/workflows/emulator-ci.yml +++ b/.github/workflows/emulator-ci.yml @@ -22,11 +22,11 @@ jobs: PIP_DISABLE_PIP_VERSION_CHECK: "1" steps: - name: Check out the tested revision - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - name: Set up Python 3.12 - uses: actions/setup-python@v7 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: python-version: "3.12" - name: Install uv 0.13.0 from Microsoft @@ -43,7 +43,7 @@ jobs: run: python -m scripts.ci_report --suite emulator - name: Preserve test results and emulator diagnostics if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: emulator-results-${{ github.run_attempt }} path: .artifacts/ @@ -64,11 +64,11 @@ jobs: OLLAMA_MAX_LOADED_MODELS: "1" steps: - name: Check out the tested revision - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - name: Set up Python 3.12 - uses: actions/setup-python@v7 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: python-version: "3.12" - name: Install uv 0.13.0 from Microsoft @@ -122,7 +122,7 @@ jobs: run: python -m scripts.ci_report --suite ollama - name: Preserve live-model results and diagnostics if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: ollama-results-${{ github.run_attempt }} path: .artifacts/ diff --git a/README.md b/README.md index 9d3e29a..c724a80 100644 --- a/README.md +++ b/README.md @@ -401,7 +401,8 @@ plus manual dispatch: - **Real agent, grounded answers and CRUD:** Ollama, Microsoft Phi-3.5, a separate emulator and the actual application test. -CI uses a disposable Ubuntu runner, loopback services, supported action release tags and +CI uses a disposable Ubuntu runner, loopback services, full-length commit SHA pins +for checkout, Python setup and artifact upload (with release-version comments), and `contents: read`. It needs no Azure subscription, inference API key or repository secret. Both jobs fail on incorrect results; configure repository rules to make their checks mandatory before merge.