Summary
.github/workflows/publish.yml — the highest-privilege workflow in the repo — pins actions by mutable tag instead of commit SHA:
- Line 29:
actions/checkout@v5
- Line 31:
pnpm/action-setup@v5
- Line 33:
actions/setup-node@v5
- Line 59:
changesets/action@v1
This workflow holds id-token: write (npm OIDC trusted publishing), contents: write, and SENTRY_AUTH_TOKEN. A compromise of any of these action tags would yield npm publish access.
Inconsistency
Other workflows in this repo already pin full commit SHAs, e.g.:
terminal-recording.yml:23,27,29,55,74action.yml:62,83,114,191
So the fix is consistent with existing practice — only the publish workflow was missed.
Suggested fix
Pin the four actions to full commit SHAs (same style as terminal-recording.yml). Optionally also add persist-credentials: false to the checkout step in publish.yml, which other workflows set but publish.yml does not.
Happy to send a PR if useful.
Summary
.github/workflows/publish.yml— the highest-privilege workflow in the repo — pins actions by mutable tag instead of commit SHA:actions/checkout@v5pnpm/action-setup@v5actions/setup-node@v5changesets/action@v1This workflow holds
id-token: write(npm OIDC trusted publishing),contents: write, andSENTRY_AUTH_TOKEN. A compromise of any of these action tags would yield npm publish access.Inconsistency
Other workflows in this repo already pin full commit SHAs, e.g.:
terminal-recording.yml:23,27,29,55,74action.yml:62,83,114,191So the fix is consistent with existing practice — only the publish workflow was missed.
Suggested fix
Pin the four actions to full commit SHAs (same style as
terminal-recording.yml). Optionally also addpersist-credentials: falseto the checkout step inpublish.yml, which other workflows set but publish.yml does not.Happy to send a PR if useful.