From dcce9dcf1ba6d2e14d0a794b67d9fc3ace722080 Mon Sep 17 00:00:00 2001 From: Dimitris Marlagkoutsos Date: Tue, 8 Sep 2026 11:54:47 +0200 Subject: [PATCH 1/2] ci: pin every third-party action to a full-length commit SHA The org now refuses any action referenced by tag: The action actions/checkout@v7 is not allowed in Consensys-Incorporated/ocap-kernel because all actions must be pinned to a full-length commit SHA. That is a setup-job failure, so it takes down every job that references one before a step runs. Nothing has run green in this repository since 2026-09-03; the policy was turned on after the last commit that touched CI, which is why merging main does not help. Each tag is replaced by the commit it currently resolves to, with the release it names in a trailing comment. Dependabot reads that comment, so `github-actions` updates keep working and arrive as a SHA bump. Local `./.github/...` references are exempt and left alone. Co-Authored-By: Claude Opus 5 (1M context) --- .github/actions/playwright-install/action.yml | 2 +- .github/workflows/changelog-check.yml | 2 +- .github/workflows/claude.yml | 2 +- .github/workflows/coverage-report.yml | 4 ++-- .github/workflows/dependabot-dedupe.yml | 6 +++--- .github/workflows/lint-build-test.yml | 18 +++++++++--------- .github/workflows/main.yml | 12 ++++++------ .github/workflows/publish-gh-pages.yml | 6 +++--- .github/workflows/publish-release.yml | 18 +++++++++--------- 9 files changed, 35 insertions(+), 35 deletions(-) diff --git a/.github/actions/playwright-install/action.yml b/.github/actions/playwright-install/action.yml index bf935813aa..09faaf5ef5 100644 --- a/.github/actions/playwright-install/action.yml +++ b/.github/actions/playwright-install/action.yml @@ -6,7 +6,7 @@ runs: steps: - name: Cache Playwright browsers id: playwright-cache - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: ~/.cache/ms-playwright key: playwright-${{ runner.os }}-${{ hashFiles('yarn.lock') }} diff --git a/.github/workflows/changelog-check.yml b/.github/workflows/changelog-check.yml index 9a2727c463..930dd3b607 100644 --- a/.github/workflows/changelog-check.yml +++ b/.github/workflows/changelog-check.yml @@ -10,7 +10,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check changelog - uses: MetaMask/github-tools/.github/actions/check-changelog@v1 + uses: MetaMask/github-tools/.github/actions/check-changelog@d0f155aad5d7b5403d29a094c2f752238bf43237 # v1.18.2 with: base-branch: ${{ github.event.pull_request.base.ref }} head-ref: ${{ github.head_ref }} diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index c6220f8d87..1616adef2a 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -26,7 +26,7 @@ jobs: actions: read # Required for Claude to read CI results on PRs steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 1 diff --git a/.github/workflows/coverage-report.yml b/.github/workflows/coverage-report.yml index 8df9dce719..a29f6a48a9 100644 --- a/.github/workflows/coverage-report.yml +++ b/.github/workflows/coverage-report.yml @@ -11,10 +11,10 @@ jobs: pull-requests: write steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Download coverage artifact - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: coverage path: coverage/ diff --git a/.github/workflows/dependabot-dedupe.yml b/.github/workflows/dependabot-dedupe.yml index 656bc80295..2f98e6f6b9 100644 --- a/.github/workflows/dependabot-dedupe.yml +++ b/.github/workflows/dependabot-dedupe.yml @@ -14,7 +14,7 @@ jobs: if: ${{ github.actor == 'dependabot[bot]' }} steps: - name: Check out repo - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.head_ref }} fetch-depth: 0 @@ -24,13 +24,13 @@ jobs: git config user.email "actions@github.com" - name: Set up Node - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 - name: Install Yarn run: corepack enable - name: Restore Yarn cache - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 cache: yarn diff --git a/.github/workflows/lint-build-test.yml b/.github/workflows/lint-build-test.yml index 37e88a8a41..4d2a83f939 100644 --- a/.github/workflows/lint-build-test.yml +++ b/.github/workflows/lint-build-test.yml @@ -12,7 +12,7 @@ jobs: node-version: [22.x, 24.x] steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: cache-node-modules: true is-high-risk-environment: false @@ -27,7 +27,7 @@ jobs: node-version: [24.x] steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: false node-version: ${{ matrix.node-version }} @@ -49,7 +49,7 @@ jobs: node-version: [24.x] steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: false node-version: ${{ matrix.node-version }} @@ -71,7 +71,7 @@ jobs: node-version: [24.x] steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: false node-version: ${{ matrix.node-version }} @@ -93,7 +93,7 @@ jobs: node-version: [22.x, 24.x] steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: false node-version: ${{ matrix.node-version }} @@ -102,7 +102,7 @@ jobs: - run: "yarn test --coverage=${{ matrix.node-version == '24.x' && 'true' || 'false' }}" - name: Upload coverage artifact if: ${{ matrix.node-version == '24.x' }} - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: coverage path: coverage/ @@ -124,7 +124,7 @@ jobs: node-version: [22.x, 24.x] steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: false node-version: ${{ matrix.node-version }} @@ -166,7 +166,7 @@ jobs: directory: evm-wallet-experiment steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: false node-version: ${{ matrix.node-version }} @@ -177,7 +177,7 @@ jobs: run: yarn workspace ${{ matrix.package }} test:e2e:ci - name: Upload test artifacts if: ${{ failure() && steps.e2e.conclusion == 'failure' }} - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: playwright-traces-${{ matrix.directory }} path: packages/${{ matrix.directory }}/test-results diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index e66ecd75d2..6d311621f0 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -18,13 +18,13 @@ jobs: skip-merge-queue: ${{ steps.check-skip-merge-queue.outputs.up-to-date }} steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 if: github.event_name == 'merge_group' - name: Check pull request merge queue status id: check-skip-merge-queue if: github.event_name == 'merge_group' - uses: MetaMask/github-tools/.github/actions/check-skip-merge-queue@v1 + uses: MetaMask/github-tools/.github/actions/check-skip-merge-queue@d0f155aad5d7b5403d29a094c2f752238bf43237 # v1.18.2 detect-changes: name: Detect changes @@ -34,7 +34,7 @@ jobs: has-ci: ${{ steps.changes.outputs.has-ci }} has-lint-targets: ${{ steps.changes.outputs.has-lint-targets }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Detect change categories @@ -121,7 +121,7 @@ jobs: (github.event_name != 'merge_group' || needs.check-skip-merge-queue.outputs.skip-merge-queue != 'true') && (needs.detect-changes.outputs.has-ci == 'true' || needs.detect-changes.outputs.has-code == 'true') steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Download actionlint id: download-actionlint run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/7fdc9630cc360ea1a469eed64ac6d78caeda1234/scripts/download-actionlint.bash) 1.6.25 @@ -150,7 +150,7 @@ jobs: node-version: [24.x] steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: false node-version: ${{ matrix.node-version }} @@ -194,7 +194,7 @@ jobs: IS_RELEASE: ${{ steps.is-release.outputs.IS_RELEASE }} steps: - id: is-release - uses: MetaMask/action-is-release@v2 + uses: MetaMask/action-is-release@3cd51b98fa98d1347d06f5961299b0172ee31ae8 # v2.3.0 with: commit-starts-with: 'Release [version],Release v[version],Release/[version],Release/v[version],Release `[version]`' diff --git a/.github/workflows/publish-gh-pages.yml b/.github/workflows/publish-gh-pages.yml index f1aa65ffaf..27a17fdf8a 100644 --- a/.github/workflows/publish-gh-pages.yml +++ b/.github/workflows/publish-gh-pages.yml @@ -26,16 +26,16 @@ jobs: id-token: write steps: - name: Download artifact - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ${{ inputs.artifact_name }} path: _site/${{ inputs.destination_dir }} - name: Upload Pages artifact - uses: actions/upload-pages-artifact@v5 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: path: _site - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v5 + uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1 diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index b63689de47..44ec99da2c 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -13,15 +13,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: true - - uses: MetaMask/action-publish-release@v3 + - uses: MetaMask/action-publish-release@f01f1be110d60fb07d86c880ce3d6bdb353524d3 # v3.3.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: yarn build - name: Upload build artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: publish-release-artifacts-${{ github.sha }} include-hidden-files: true @@ -41,16 +41,16 @@ jobs: needs: publish-release steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: true ref: ${{ github.sha }} - name: Restore build artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: publish-release-artifacts-${{ github.sha }} - name: Dry run publish to NPM - uses: MetaMask/action-npm-publish@v6 + uses: MetaMask/action-npm-publish@18df42148c35aabb98e00f9fda127d421af141df # v6.5.0 publish-npm: name: Publish to NPM @@ -64,15 +64,15 @@ jobs: needs: publish-npm-dry-run steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: true ref: ${{ github.sha }} - name: Restore build artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: publish-release-artifacts-${{ github.sha }} - name: Publish to NPM - uses: MetaMask/action-npm-publish@v6 + uses: MetaMask/action-npm-publish@18df42148c35aabb98e00f9fda127d421af141df # v6.5.0 with: npm-token: ${{ secrets.NPM_TOKEN }} From 9141b74d206a7dec4739d293793157dc21f25c23 Mon Sep 17 00:00:00 2001 From: Dimitris Marlagkoutsos Date: Tue, 8 Sep 2026 19:38:31 +0200 Subject: [PATCH 2/2] ci: name the release in the two pins that lacked a comment Both were already pinned by SHA, so the policy was satisfied, but neither named the release it points at, leaving a reader to resolve the hash by hand. anthropics/claude-code-action c9ec2b02 -> v1.0.28 davelosert/vitest-coverage-report-action 5b6122e3 -> v2.9.0 Dependabot's `github-actions` allow list covers only `actions/*` and `MetaMask/*`, so neither gets an automated bump either way. The comment is for people. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/claude.yml | 2 +- .github/workflows/coverage-report.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 1616adef2a..a5042e6555 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -32,7 +32,7 @@ jobs: - name: Run Claude Code id: claude - uses: anthropics/claude-code-action@c9ec2b02b40ac0444c6716e51d5e19ef2e0b8d00 + uses: anthropics/claude-code-action@c9ec2b02b40ac0444c6716e51d5e19ef2e0b8d00 # v1.0.28 with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} diff --git a/.github/workflows/coverage-report.yml b/.github/workflows/coverage-report.yml index a29f6a48a9..1a390e9e87 100644 --- a/.github/workflows/coverage-report.yml +++ b/.github/workflows/coverage-report.yml @@ -36,7 +36,7 @@ jobs: fi - name: Post coverage report - uses: davelosert/vitest-coverage-report-action@5b6122e3a819a3be7b27fc961b7faafb3bf00e4d + uses: davelosert/vitest-coverage-report-action@5b6122e3a819a3be7b27fc961b7faafb3bf00e4d # v2.9.0 with: json-summary-path: coverage/coverage-summary.json json-final-path: coverage/coverage-final.json