From c1a3f3a3613d917e06ef03c3d3b0cd74291bd6a5 Mon Sep 17 00:00:00 2001 From: Andrew Yager Date: Wed, 27 May 2026 18:26:52 +1000 Subject: [PATCH 1/3] Bump softprops/action-gh-release v2 -> v3 for Node 24 The previous release workflow run logged the GitHub Actions deprecation warning for Node 20-based actions: Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: softprops/action-gh-release@v2. Upstream v3.0.0 is a runtime-only bump: bundle target moves from Node 20 to Node 24, no API or behavioural changes. The v2 line stays pinned to 2.6.2 for fleets that don't yet have Node 24, which we don't need. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6f0336c..c3ff744 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -262,7 +262,7 @@ jobs: # Note: rwts-codesign.cer (public cert) is kept - needed for release upload and is non-sensitive - name: Create GitHub Release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@v3 with: name: v${{ steps.version.outputs.VERSION }} body_path: release_notes.md From cb16a3eb81222aa76c01459bcf31b58a04f23164 Mon Sep 17 00:00:00 2001 From: Andrew Yager Date: Wed, 27 May 2026 18:28:21 +1000 Subject: [PATCH 2/3] SHA-pin softprops/action-gh-release to v3.0.0 The release job runs in the protected `release` environment and has the code-signing PFX in scope. A floating major tag (@v3) on a third-party action means an upstream account compromise could be used to repoint the tag at malicious code that exfiltrates the signing secrets or modifies what gets uploaded post-signing. Pin to the v3.0.0 commit so future bumps are deliberate and reviewable. A trailing comment preserves the human-readable version so reviewers don't have to resolve the SHA manually. `actions/checkout` is first-party (GitHub itself) and is left on its floating major tag. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/release.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c3ff744..f67ceb8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -262,7 +262,12 @@ jobs: # Note: rwts-codesign.cer (public cert) is kept - needed for release upload and is non-sensitive - name: Create GitHub Release - uses: softprops/action-gh-release@v3 + # SHA-pinned to v3.0.0. This job has the code-signing PFX in scope + # via the protected `release` environment; pinning the third-party + # action to a specific commit removes the supply-chain risk of a + # mutable major tag being repointed at malicious code. Bump + # deliberately when a new version is published and reviewed. + uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0 with: name: v${{ steps.version.outputs.VERSION }} body_path: release_notes.md From dce4ad0fd70edb38de32e57c773d79bb087164a8 Mon Sep 17 00:00:00 2001 From: Andrew Yager Date: Wed, 27 May 2026 18:34:41 +1000 Subject: [PATCH 3/3] SHA-pin actions/checkout to v5.0.1 across all workflows Make the action-pinning policy consistent across the repo: every workflow now references its dependencies by full commit SHA with a trailing comment showing the human-readable version. The previous commit pinned softprops/action-gh-release (third-party, runs in the signing-secrets environment); this one applies the same treatment to actions/checkout for consistency, even though it is first-party and the supply-chain risk profile is lower. @v5 currently floats to v5.0.1 (93cb6ef), so this is a no-op in terms of bits shipped to the runner today; future v5.x bumps will now require a deliberate SHA change rather than appearing implicitly. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/ci.yml | 2 +- .github/workflows/release.yml | 4 ++-- .github/workflows/test-signing.yml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9707770..035b729 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -11,7 +11,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 - name: Run PSScriptAnalyzer shell: pwsh diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f67ceb8..91b1bfe 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,7 +14,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 - name: Run PSScriptAnalyzer shell: pwsh @@ -35,7 +35,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 - name: Get version from tag id: version diff --git a/.github/workflows/test-signing.yml b/.github/workflows/test-signing.yml index 447958d..493a5c3 100644 --- a/.github/workflows/test-signing.yml +++ b/.github/workflows/test-signing.yml @@ -10,7 +10,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 - name: Test certificate and signing shell: pwsh