Skip to content

Compliance: unpinned-actions-dependency-audit.yml #158

Closed
Closed
Compliance: unpinned-actions-dependency-audit.yml#158
Labels
compliance-auditAutomated compliance audit findingdev-leadFor dev-lead agent pickup

Description

@don-petry
don-petry
opened on Apr 9, 2026

Compliance Finding

Category: action-pinning
Severity: error
Check: unpinned-actions-dependency-audit.yml

Detail

Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1

Standard Reference

standards/ci-standards.md#action-pinning-policy

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

This issue was automatically created by the weekly compliance audit.

Activity

  1. don-petry
    added
    compliance-auditAutomated compliance audit finding
    on Apr 9, 2026

  2. don-petry commented on Apr 9, 2026

    @don-petry
    don-petry
    on Apr 9, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-04-09)

    This finding is still open.

    Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1

    Standard: standards/ci-standards.md#action-pinning-policy

  3. don-petry
    added
    claude
    on Apr 9, 2026

  4. don-petry commented on Apr 9, 2026

    @don-petry
    don-petry
    on Apr 9, 2026
    CollaboratorAuthor

    Claude encountered an error —— View job

    I'll analyze this and get back to you.

  5. don-petry commented on Apr 10, 2026

    @don-petry
    don-petry
    on Apr 10, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-04-10)

    This finding is still open.

    Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1

    Standard: standards/ci-standards.md#action-pinning-policy

  6. don-petry
    added
    claude
    and removed
    claude
    on Apr 14, 2026

  7. don-petry commented on Apr 14, 2026

    @don-petry
    don-petry
    on Apr 14, 2026
    CollaboratorAuthor

    Claude finished @don-petry's task in 1m 2s —— View job • claude/issue-158-20260414-1122 • Create PR ➔

    Fixing Compliance: Unpinned Actions in dependency-audit.yml

    • Gather context and understand the issue
    • Fetch the standard template for dependency-audit.yml
    • Look up SHA for the v1 tag of petry-projects/.github → ae9709f4466dec60a5733c9e7487f69dcd004e05
    • Update dependency-audit.yml with SHA-pinned action
    • Commit and push changes
    • Create PR fix: pin dependency-audit reusable workflow to SHA #182

    Summary

    Pinned the reusable workflow reference from @v1 to the resolved commit SHA:

    # Before
uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1

# After
uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@ae9709f4466dec60a5733c9e7487f69dcd004e05 # v1

    |

  8. don-petry commented on Apr 17, 2026

    @don-petry
    don-petry
    on Apr 17, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-04-17)

    This finding is still open.

    Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1

    Standard: standards/ci-standards.md#action-pinning-policy

  9. don-petry
    added
    claude
    and removed
    claude
    on Apr 18, 2026

  10. don-petry commented on Apr 18, 2026

    @don-petry
    don-petry
    on Apr 18, 2026
    CollaboratorAuthor

    Claude finished @don-petry's task in 3m 23s —— View job • claude/issue-158-20260418-1852 • [Create PR ➔](https://github.com/petry-projects/google-app-scripts/compare/main...claude/issue-158-20260418-1852?quick_pull=1&title=Issue%20%23158%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%23158%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

    Fixing Compliance: Unpinned Actions in dependency-audit.yml

    • Gather context and understand the issue
    • Fetch the standard template for dependency-audit.yml
    • Look up SHA for the v1 tag of petry-projects/.github → ee22b427cbce9ecadcf2b436acb57c3adf0cb63d
    • Update dependency-audit.yml with SHA-pinned action
    • Commit and push changes
    • Create PR #202
    • Self-review — single-line change is correct; SHA resolved via API
    • Tagged @don-petry for review on PR fix: pin dependency-audit reusable workflow to SHA #202

    Summary

    Pinned the reusable workflow reference from @v1 to the resolved commit SHA:

    # Before
uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1

# After
uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@ee22b427cbce9ecadcf2b436acb57c3adf0cb63d # v1

    Note: PR #182 (previous attempt) is still open but uses an older SHA — the v1 tag has since moved. Please close #182 and merge #202 instead.

    CI is queued; once it passes, @don-petry can merge PR #202 to close this issue.
    • Branch

  11. don-petry
    added a commit that references this issue on Apr 18, 2026

    fix: pin dependency-audit reusable workflow to SHA

    c7e62dc
  12. don-petry
    added
    claude
    and removed
    claude
    on Apr 19, 2026

  13. 22 remaining items

  14. don-petry
    added
    claude
    and removed
    claude
    on May 21, 2026

  15. don-petry commented on May 21, 2026

    @don-petry
    don-petry
    on May 21, 2026
    CollaboratorAuthor
    Already working on this: an open PR exists for issue #158.
  16. don-petry
    added
    claude
    and removed
    claude
    on May 23, 2026

  17. don-petry commented on May 26, 2026

    @don-petry
    don-petry
    on May 26, 2026
    CollaboratorAuthor

    Resolved! This check is now passing as of 2026-05-26. Closing automatically.

  18. don-petry
    closed this as completedon May 26, 2026
  19. don-petry
    reopened this on Jun 2, 2026
  20. don-petry
    added
    dev-leadFor dev-lead agent pickup
    on Jun 2, 2026

  21. don-petry commented on Jun 2, 2026

    @don-petry
    don-petry
    on Jun 2, 2026
    CollaboratorAuthor

    Dev-Lead Implementation Plan

    Issue: #158 — Compliance: unpinned-actions-dependency-audit.yml

    Scope

    Pin the uses: reference in .github/workflows/dependency-audit.yml to the SHA corresponding to the v2 tag of the petry-projects/.github reusable workflow, matching the org-wide action-pinning policy.

    Implementation Checklist

    • Resolve the SHA for petry-projects/.github tag v2 (found: 376a4fcb1117444595e3e702fa450873d0e54310)
    • Update .github/workflows/dependency-audit.yml line 33: replace @v2 with @376a4fcb1117444595e3e702fa450873d0e54310 # v2

    Tests to Write

    • N/A — this is a pure YAML configuration change (no executable code). GitHub Actions workflow files have no Jest/unit test coverage. TDD phase is skipped per the exception clause for behavior-preserving config changes.

    Test Command

    npm test (no new tests; existing suite validates nothing broke in source code)

  22. don-petry commented on Jun 2, 2026

    @don-petry
    don-petry
    on Jun 2, 2026
    CollaboratorAuthor

    Dev-Lead: Implementation Complete

    Plan Execution

    • Resolved SHA for petry-projects/.github tag v2: 376a4fcb1117444595e3e702fa450873d0e54310
    • Updated .github/workflows/dependency-audit.yml to pin uses: to SHA with # v2 comment

    Test Results

    Test Suites: 12 passed, 12 total
Tests:       301 passed, 301 total
Snapshots:   0 total
Time:        4.225 s
Ran all test suites.

npm run check: 0 errors (22 pre-existing warnings in unrelated files)

    Files Changed

    • .github/workflows/dependency-audit.yml: replaced @v2 with @376a4fcb1117444595e3e702fa450873d0e54310 # v2 on the uses: line, matching the org action-pinning pattern used in dependabot-rebase.yml, pr-review-mention.yml, etc.

    Notes

    • TDD phase skipped: this is a pure YAML configuration change with no executable code and no behavioral difference — the SHA resolves to the same commit as the v2 tag.
    • The SHA was verified via gh api repos/petry-projects/.github/git/refs/tags/v2.

  23. don-petry commented on Jun 5, 2026

    @don-petry
    don-petry
    on Jun 5, 2026
    CollaboratorAuthor

    Resolved! This check is now passing as of 2026-06-05. Closing automatically.

  24. don-petry
    closed this as completedon Jun 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    compliance-auditAutomated compliance audit findingdev-leadFor dev-lead agent pickup

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions