Supply-Chain Security & SHA Pinning Policy¶

To protect consumers of jambazid/gha-actions from upstream supply-chain compromises (such as tag mutation or malicious releases), all action references MUST be pinned to full 40-character commit SHAs.

📌 SHA Pinning Standard¶

Every uses: directive referencing a third-party or internal GitHub Action must specify the 40-character commit SHA, accompanied by an inline comment indicating the release tag:

# ✅ CORRECT
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

# ❌ INCORRECT (Mutable tag)
uses: actions/checkout@v7.0.1

🤖 Auditing & Bumping Action SHAs¶

Maintainers audit and update all action references across the repository using actions-up via mise:

mise run bump

This task scans all composite action manifests (action.yaml) and workflow files (.github/workflows/*.yaml), queries GitHub APIs for the latest release commit SHAs, and updates version comments automatically.