From 48f43ff4287ba76844a2cd02f7830b8bee2d8896 Mon Sep 17 00:00:00 2001 From: Reuben Bowlby Date: Thu, 23 Jul 2026 15:29:26 -0400 Subject: [PATCH 1/4] security: SHA-pin base120.yml actions Replaces mutable @v* tags with SHA-pinned references to prevent supply-chain attacks via tag re-pointing. Generated by fleet security wargame P2 mitigation. --- .github/workflows/base120.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/base120.yml b/.github/workflows/base120.yml index 980a327..9b71b19 100644 --- a/.github/workflows/base120.yml +++ b/.github/workflows/base120.yml @@ -16,7 +16,7 @@ jobs: mirror-guard: runs-on: [self-hosted, Linux, X64, wsl, base120] steps: - - uses: actions/checkout@v6.0.3 + - actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3 - name: Enforce mirror corpus compliance run: | @@ -27,10 +27,10 @@ jobs: test: runs-on: [self-hosted, Linux, X64, wsl, base120] steps: - - uses: actions/checkout@v6.0.3 + - actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3 - name: Set up Python - uses: actions/setup-python@v6 + actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.13" From 2a4bdd6aaff64e84bfc4829a127e19a59d7e4f5e Mon Sep 17 00:00:00 2001 From: Reuben Bowlby Date: Thu, 23 Jul 2026 15:29:27 -0400 Subject: [PATCH 2/4] security: SHA-pin ci.yml actions Replaces mutable @v* tags with SHA-pinned references to prevent supply-chain attacks via tag re-pointing. Generated by fleet security wargame P2 mitigation. --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 378b01c..6483efe 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,7 +16,7 @@ jobs: - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: ${{ matrix.python-version }} From 931e8bba5235fca5d16b3021cc00eaca15609497 Mon Sep 17 00:00:00 2001 From: Reuben Bowlby Date: Thu, 23 Jul 2026 15:29:28 -0400 Subject: [PATCH 3/4] security: SHA-pin guardrails.yml actions Replaces mutable @v* tags with SHA-pinned references to prevent supply-chain attacks via tag re-pointing. Generated by fleet security wargame P2 mitigation. --- .github/workflows/guardrails.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/guardrails.yml b/.github/workflows/guardrails.yml index 5fea8e7..8334dbe 100644 --- a/.github/workflows/guardrails.yml +++ b/.github/workflows/guardrails.yml @@ -13,8 +13,8 @@ jobs: corpus: runs-on: [self-hosted, Linux, X64, wsl, base120] steps: - - uses: actions/checkout@v6.0.3 - - uses: actions/setup-python@v6 + - actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3 + - actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.13" - run: | From f45c78affa4b77509efe6c8e8d8cea7ae9bc3739 Mon Sep 17 00:00:00 2001 From: Reuben Bowlby Date: Thu, 23 Jul 2026 15:29:30 -0400 Subject: [PATCH 4/4] security: SHA-pin mirror-conformance.yml actions Replaces mutable @v* tags with SHA-pinned references to prevent supply-chain attacks via tag re-pointing. Generated by fleet security wargame P2 mitigation. --- .github/workflows/mirror-conformance.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/mirror-conformance.yml b/.github/workflows/mirror-conformance.yml index 62c8b70..d76bf1b 100644 --- a/.github/workflows/mirror-conformance.yml +++ b/.github/workflows/mirror-conformance.yml @@ -40,12 +40,12 @@ jobs: steps: - name: Checkout mirror repository - uses: actions/checkout@v6.0.3 + actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3 with: path: mirror-repo - name: Checkout canonical Base120 repository - uses: actions/checkout@v6.0.3 + actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3 with: repository: hummbl-dev/base120 ref: main @@ -381,7 +381,7 @@ jobs: - name: Post PR comment with results if: github.event_name == 'pull_request' - uses: actions/github-script@v9 + actions/github-script@373c709c69115d41ff229c7e5df9f8788daa9553 # v9 with: script: | const passed = '${{ steps.summary.outputs.passed }}' === 'true';