fix(ci): pin GitHub Actions to immutable commit SHAs by vitormattos · Pull Request #85 · LibreCodeCoop/nextcloud-docker

vitormattos · 2026-10-22T14:31:18Z

Summary

Pin 21 mutable GitHub Actions/reusable-workflow references to verified 40-character commit SHAs with version comments.
Use a Bats test in the existing CI suite to reject unpinned references, without adding Python.
Keep Dependabot responsible for Actions updates; Renovate continues managing Nextcloud image digests and Trivy.

13 distinct SHA/version pairs verified against upstream Git tags.
25 Bats CI tests, 5 development tests, Actionlint and scan-wrapper tests passed locally.
Negative tests confirm mutable tags and missing version comments are rejected.

The NCDD workflow example pins a main snapshot and must be refreshed when its upstream workflow changes.

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

vitormattos added 3 commits October 22, 2026 11:31

fix(ci): pin GitHub Actions to immutable release commits

d67cd07

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

test(ci): enforce immutable action pins with Bats

2d6c540

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

style(ci): wrap Bats targets in Makefile

9f0c609

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

vitormattos merged commit b2639e4 into main Oct 22, 2026
9 checks passed