From 6a9499f8c11f66fc74a391c5c5666928ed806680 Mon Sep 17 00:00:00 2001 From: Rajnish Tiwari <121179385+rajnisht7@users.noreply.github.com> Date: Wed, 26 Aug 2026 11:48:25 +0530 Subject: [PATCH 1/3] Update reusable-python-security.yml --- .github/workflows/reusable-python-security.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/reusable-python-security.yml b/.github/workflows/reusable-python-security.yml index a9457a9..0605c38 100644 --- a/.github/workflows/reusable-python-security.yml +++ b/.github/workflows/reusable-python-security.yml @@ -11,8 +11,8 @@ jobs: static-and-deps: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 # TODO: pin to commit SHA before merge - - uses: actions/setup-python@v5 # TODO: pin to commit SHA before merge + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 with: python-version: "${{ inputs.python-version }}" - run: pip install ruff mypy bandit pip-audit cyclonedx-bom @@ -26,7 +26,7 @@ jobs: run: pip-audit - name: SBOM (CycloneDX) run: cyclonedx-py environment -o sbom.json || true - - uses: actions/upload-artifact@v4 # TODO: pin to commit SHA before merge + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: sbom path: sbom.json From 78d8e043595d030baff327eceee52481ac6aad5d Mon Sep 17 00:00:00 2001 From: Rajnish Tiwari <121179385+rajnisht7@users.noreply.github.com> Date: Wed, 26 Aug 2026 11:50:13 +0530 Subject: [PATCH 2/3] Update security-baseline.md --- docs/security-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/security-baseline.md b/docs/security-baseline.md index 93cb5b4..2f25dff 100644 --- a/docs/security-baseline.md +++ b/docs/security-baseline.md @@ -25,6 +25,6 @@ Each repo should also carry, matching cmcp / ca2a / agent-manifest: Copy-paste versions of these, plus the org-level settings (secret scanning, push protection, Dependabot alerts, and the branch-protection ruleset), are in the internal security hardening bundle. -## Note +## Action pinning -All third-party actions must be pinned to a commit SHA before merge. The reusable workflow currently uses version tags marked with `TODO`. +All actions first-party (`actions/*`) and third-party (e.g. `anchore/sbom-action`) are pinned to a commit SHA with a `# vX.Y.Z` comment for readability. This applies org-wide; see `reusable-python-security.yml` and `sbom.yml` in cmcp / ca2a / trace-spec for the pattern. When bumping a version, update both the SHA and the comment together. From 987175f86624c607a0db40a34178738a04562602 Mon Sep 17 00:00:00 2001 From: Rajnish Tiwari <121179385+rajnisht7@users.noreply.github.com> Date: Wed, 26 Aug 2026 11:51:11 +0530 Subject: [PATCH 3/3] Update reusable-python-security.yml Signed-off-by: rajnisht7 --- .github/workflows/reusable-python-security.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/reusable-python-security.yml b/.github/workflows/reusable-python-security.yml index 0605c38..9990c38 100644 --- a/.github/workflows/reusable-python-security.yml +++ b/.github/workflows/reusable-python-security.yml @@ -11,8 +11,8 @@ jobs: static-and-deps: runs-on: ubuntu-latest steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: "${{ inputs.python-version }}" - run: pip install ruff mypy bandit pip-audit cyclonedx-bom