Use Commit Hashes to Version Reusable Github Actions Tasks

[sarina]

In response to https://www.bleepingcomputer.com/news/security/supply-chain-attack-on-popular-github-action-exposes-ci-cd-secrets/ we should move to pinning GitHub Action versions by commit hash.

Some resources:

• Not natively supported: Support "lock file" equivalent for GitHub actions actions/runner#2195
• Dependabot may support this: For actions that are pinned-by-hash, bump the human readable version number in the code comment dependabot/dependabot-core#4691
• We may be able to run pinact as a one-off and then leverage Dependabot after that.

[arbrandes]

@farhan, have you been able to look into this at all, yet?

[farhan]

@arbrandes We tried https://github.com/suzuki-shunsuke/pinact, it's working fine
How can we run it in all the repositories, this what we were discussing yesterday
We are on the edge of getting relax from the XBlock extraction work, we have prioritize it as next.

[irfanuddinahmad]

Dependabot alone is not a strict enforcement mechanism for SHA pinning. It is excellent for ongoing updates, but it does not by itself guarantee that repos using tag-based uses: refs will automatically move to SHA-pinned refs in the next PR.

Proposed path forward:

1. One-time baseline migration to SHA-pinned action refs
   Convert workflow uses: references from tags to full commit SHA with a human-readable version comment.
   Example format:
   uses: actions/checkout@<40-char-sha> # vX.Y.Z
2. Keep Dependabot for ongoing maintenance
   Continue weekly github-actions updates in repos.
   After the baseline is SHA-pinned, Dependabot can keep SHA + comment updated over time.
3. Add enforcement so tags cannot be reintroduced
   Add a required CI check (for example pinact run --check or equivalent policy check) that fails if external actions are not pinned to full SHA. This provides durable protection against future drift back to tags.
4. Optional platform guardrail
   If available in org settings, enable GitHub Actions policy requiring full-length commit SHA pinning for actions.