Pin GitHub Actions to full commit SHAs

[csontosati]

No description provided.

[qodo-app-for-konflux-ci]

PR Summary by Qodo

Pin GitHub Actions workflow dependencies to full commit SHAs

⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Replace GitHub Actions tag/branch refs with full commit SHAs across workflows.
• Add inline version comments to preserve human-readable action versions.
• Align CI configuration with konflux-ci policy requiring immutable action references.

Diagram

graph TD
  GA["GitHub Actions Runner"] --> WF["Workflows (.github/workflows)"]
  WF --> CO("actions/checkout@fbc6f39")
  WF --> OA("Other actions@SHAs")
  WF --> RW("Reusable workflow@701e62a")

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Add Dependabot/Renovate updates for action SHAs

• ➕ Keeps pinned SHAs current with security fixes automatically
• ➕ Reduces manual maintenance as upstream actions release updates
• ➖ Adds PR churn and requires initial configuration/tuning
• ➖ May need allowlist rules for workflow file updates

2. Consolidate repeated steps into reusable workflows

• ➕ Reduces duplication of pinned refs across many workflow files
• ➕ Centralizes future action upgrades to a single place
• ➖ Refactor cost is higher than the compliance-only change in this PR
• ➖ May be constrained by current workflow structure and reuse boundaries

Recommendation: Proceed with this PR as-is since it directly satisfies the org policy with minimal risk. Consider adding an automated updater (Dependabot/Renovate) next to keep pinned SHAs from going stale; reusable-workflow consolidation is optional and better suited to a follow-up refactor if duplication becomes painful.

Files changed (8) +12 / -12

Other (8) +12 / -12

checkton.yamlPin checkout and checkton action refs to commit SHAs +2/-2

Pin checkout and checkton action refs to commit SHAs

• Replaces 'actions/checkout@v5' and 'chmeliik/checkton@v0.4.0' with full commit SHAs. Adds inline comments to preserve the original version identifiers for readability.

.github/workflows/checkton.yaml

fullsend.yamlPin reusable workflow dispatch reference to a commit SHA +1/-1

Pin reusable workflow dispatch reference to a commit SHA

• Replaces 'konflux-ci/.fullsend/...@main' with an immutable commit SHA reference. Retains a comment indicating it previously tracked 'main'.

.github/workflows/fullsend.yaml

gitleaks.yamlPin checkout action ref to a commit SHA +1/-1

Pin checkout action ref to a commit SHA

• Replaces 'actions/checkout@v5' with a full commit SHA while keeping behavior unchanged (full history fetch remains configured).

.github/workflows/gitleaks.yaml

hadolint.yamlPin checkout and hadolint action refs to commit SHAs +2/-2

Pin checkout and hadolint action refs to commit SHAs

• Replaces 'actions/checkout@v5' and 'hadolint/hadolint-action@v3.1.0' with full commit SHAs. Keeps a comment mapping the SHA back to the intended release version.

.github/workflows/hadolint.yaml

shellcheck.yamlPin checkout action ref to a commit SHA +1/-1

Pin checkout action ref to a commit SHA

• Replaces 'actions/checkout@v5' with a full commit SHA to comply with immutable reference requirements.

.github/workflows/shellcheck.yaml

validate-agents-md.yamlPin checkout action ref to a commit SHA +1/-1

Pin checkout action ref to a commit SHA

• Updates the workflow to use 'actions/checkout' via a full commit SHA while preserving the step structure and runner selection.

.github/workflows/validate-agents-md.yaml

validate-task-and-pipeline-yamls.yamlPin checkout, kind-action, and setup-tektoncd refs to commit SHAs +3/-3

Pin checkout, kind-action, and setup-tektoncd refs to commit SHAs

• Replaces tag/branch refs for 'actions/checkout', 'helm/kind-action', and 'tektoncd/actions/setup-tektoncd' with full commit SHAs. Keeps existing behavior (cluster creation, Tekton setup) unchanged.

.github/workflows/validate-task-and-pipeline-yamls.yaml

yaml-lint.yamlPin checkout action ref to a commit SHA +1/-1

Pin checkout action ref to a commit SHA

• Replaces 'actions/checkout@v5' with a full commit SHA; lint invocation remains the same.

.github/workflows/yaml-lint.yaml

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:08 AM UTC · Completed 10:19 AM UTC

Commit: 701e62a · View workflow run →

[qodo-app-for-konflux-ci]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can reply 'qodo' on any finding to push back, ask questions, or dig deeper

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[fullsend-ai-review]

Review

Findings

High

• [protected-path] .github/workflows/ — All 8 changed files are under the .github/ protected path, which requires human approval for modifications. The PR has no linked issue and no description explaining the rationale for modifying governance/infrastructure files. Affected files: checkton.yaml, fullsend.yaml, gitleaks.yaml, hadolint.yaml, shellcheck.yaml, validate-agents-md.yaml, validate-task-and-pipeline-yamls.yaml, yaml-lint.yaml.
  Remediation: Add a PR description explaining the rationale for these changes, or link an authorizing issue. Human approval is always required for protected-path changes.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-review]

See the review comment for full details.