svelte

Commit Graph

Author	SHA1	Message	Date
dagecko	e0f925116c	fix: pin 9 actions to commit SHA (#18025 ) Re-submission of #18017. Had a problem with my fork and had to delete it, which closed the original PR. Apologies for the noise. ## Summary This PR pins all GitHub Actions to immutable commit SHAs instead of mutable version tags. - Pin 9 unpinned actions to full 40-character SHAs - Add version comments for readability ## Changes by file \| File \| Changes \| \|------\|---------\| \| autofix.yml \| Pinned actions to SHA \| \| ci.yml \| Pinned actions to SHA \| \| pkg.pr.new.yml \| Pinned actions to SHA \| \| release.yml \| Pinned actions to SHA \| ## A note on internal action pinning This PR pins all actions including org-owned ones. Best practice is to pin everything — the tj-actions/changed-files attack was an internally maintained action that was compromised, and every repo referencing it by tag silently executed attacker code. That said, it's your codebase. If you'd prefer to leave org-owned actions unpinned, let us know and we'll adjust the PR. ## How to verify Review the diff — each change is mechanical and preserves workflow behavior: - SHA pinning: `action@v3` becomes `action@abc123 # v3` — original version preserved as comment - No workflow logic, triggers, or permissions are modified I wrote a scanner called Runner Guard and open sourced it [here](https://github.com/Vigilant-LLC/runner-guard). If you have any questions, reach out. I'll be monitoring comms. \- Chris Nyhuis (dagecko)	5 months ago
Rich Harris	ee3807ecbe	fix autofix (#17923 ) we need to build the compiler before Prettier will work	5 months ago
Rich Harris	ad94009e34	chore: add autofix workflow (#17922 ) lets maintainers comment `/autofix` to trigger Prettier and regenerate messages/types/etc --------- Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>	5 months ago

Author

SHA1

Message

Date

dagecko

e0f925116c

fix: pin 9 actions to commit SHA (#18025 )

Re-submission of #18017. Had a problem with my fork and had to delete
it, which closed the original PR. Apologies for the noise.

## Summary

This PR pins all GitHub Actions to immutable commit SHAs instead of
mutable version tags.

- Pin 9 unpinned actions to full 40-character SHAs
- Add version comments for readability

## Changes by file

| File | Changes |
|------|---------|
| autofix.yml | Pinned actions to SHA |
| ci.yml | Pinned actions to SHA |
| pkg.pr.new.yml | Pinned actions to SHA |
| release.yml | Pinned actions to SHA |

## A note on internal action pinning

This PR pins all actions including org-owned ones. Best practice is to
pin everything — the tj-actions/changed-files attack was an internally
maintained action that was compromised, and every repo referencing it by
tag silently executed attacker code. That said, it's your codebase. If
you'd prefer to leave org-owned actions unpinned, let us know and we'll
adjust the PR.

## How to verify

Review the diff — each change is mechanical and preserves workflow
behavior:
- **SHA pinning**: `action@v3` becomes `action@abc123 # v3` — original
version preserved as comment
- No workflow logic, triggers, or permissions are modified

I wrote a scanner called Runner Guard and open sourced it
[here](https://github.com/Vigilant-LLC/runner-guard).

If you have any questions, reach out. I'll be monitoring comms.

\- Chris Nyhuis (dagecko)

Rich Harris

ee3807ecbe

fix autofix (#17923 )

we need to build the compiler before Prettier will work

Rich Harris

ad94009e34

chore: add autofix workflow (#17922 )

lets maintainers comment `/autofix` to trigger Prettier and regenerate
messages/types/etc

---------

Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>

3 Commits (paoloricciuti/issue-17720-print-parse-code-produces-broken-code-ae5d2b)