feat(ci): Pin action versions to commit SHAs by Ayushmore1214 · Pull Request #5876 · backstage/community-plugins

Ayushmore1214 · 2025-10-19T06:28:23Z

Hey, I just made a Pull Request!

Making our CI/CD a little more secure this pins all actions to specific commit sha, preventing unexpected breaks or supply-chain risk

✔️ Checklist

A changeset describing the change and affected packages. (more info)
Added or updated documentation
Tests for new functionality and regression tests for bug fixes
Screenshots attached (for UI changes)
All your commits have a Signed-off-by line in the message. (more info)

Signed-off-by: Ayush More <ayushmore42595@gmail.com>

Ayushmore1214 · 2025-10-19T06:28:58Z

@benjdlambert plz review

awanlin

Thanks for these changes @Ayushmore1214, spotted some typos and a pair of missed items.

I think we also should make changes to this file so that we automatically stay up to date with changes:

community-plugins/.github/renovate.json

Lines 1 to 10 in e6bd3fc

    
           { 
        
             "extends": [ 
        
               "config:best-practices", 
        
               ":gitSignOff", 
        
               ":rebaseStalePrs", 
        
               "group:linters", 
        
               "group:test", 
        
               ":preserveSemverRanges" 
        
             ], 
        
             "ignorePresets": [":pinDevDependencies", ":pinDigest", "docker:pinDigests"],

We should be able to just add "helpers:pinGitHubActionDigests" to the extends array to enable that.

Co-authored-by: Andre Wanlin <67169551+awanlin@users.noreply.github.com> Signed-off-by: Ayush More <ayushmore42595@gmail.com>

Signed-off-by: Ayush More <ayushmore42595@gmail.com>

Ayushmore1214 · 2025-10-25T10:03:04Z

@awanlin thank you for your review , I have made the changes respectively

Ayushmore1214 · 2025-10-25T10:09:42Z

Thanks for these changes @Ayushmore1214, spotted some typos and a pair of missed items.

I think we also should make changes to this file so that we automatically stay up to date with changes:

community-plugins/.github/renovate.json

Lines 1 to 10 in e6bd3fc

{

"extends": [

"config:best-practices",

":gitSignOff",

":rebaseStalePrs",

"group:linters",

"group:test",

":preserveSemverRanges"

],

"ignorePresets": [":pinDevDependencies", ":pinDigest", "docker:pinDigests"],

We should be able to just add "helpers:pinGitHubActionDigests" to the extends array to enable that.

Thank you for this , just wondering do you think this should also be added to the Renovate config in the main backstage/backstage repository for same security benefitts?

awanlin

Thanks for the follow up @Ayushmore1214, left one new comment to address.

Signed-off-by: Ayush More <ayushmore42595@gmail.com>

Ayushmore1214 · 2025-10-30T09:10:30Z

Done

awanlin

Hi @Ayushmore1214, left one comment 🙏

Signed-off-by: Ayush More <ayushmore42595@gmail.com>

awanlin

Awesome, let's get this merged @Ayushmore1214 🚀

This reverts commit 0ec0afa.

This reverts commit 0ec0afa. Signed-off-by: Andre Wanlin <awanlin@spotify.com>

awanlin · 2025-11-21T18:24:19Z

We ended up having to revert this change as the SHA's were not correct: #6117. Given this I'd prefer to let Renovate eventually generate the PR for these changes.

* feat(ci): Pin action versions to commit SHAs Signed-off-by: Ayush More <ayushmore42595@gmail.com> * Update .github/workflows/auto-version-bump-scheduler.yml Co-authored-by: Andre Wanlin <67169551+awanlin@users.noreply.github.com> Signed-off-by: Ayush More <ayushmore42595@gmail.com> * Update .github/workflows/auto-version-bump-scheduler.yml Co-authored-by: Andre Wanlin <67169551+awanlin@users.noreply.github.com> Signed-off-by: Ayush More <ayushmore42595@gmail.com> * Update .github/workflows/deprecate-archived-plugins.yml Co-authored-by: Andre Wanlin <67169551+awanlin@users.noreply.github.com> Signed-off-by: Ayush More <ayushmore42595@gmail.com> * fixed the typos Signed-off-by: Ayush More <ayushmore42595@gmail.com> * Remove helper for pinning GitHub Action digests Signed-off-by: Ayush More <ayushmore42595@gmail.com> * Fix formatting in renovate.json Signed-off-by: Ayush More <ayushmore42595@gmail.com> --------- Signed-off-by: Ayush More <ayushmore42595@gmail.com> Co-authored-by: Andre Wanlin <67169551+awanlin@users.noreply.github.com> Signed-off-by: Max Ramer <maxjramer@gmail.com>

backstage#6117) This reverts commit 0ec0afa. Signed-off-by: Andre Wanlin <awanlin@spotify.com> Signed-off-by: Max Ramer <maxjramer@gmail.com>

* feat(ci): Pin action versions to commit SHAs Signed-off-by: Ayush More <ayushmore42595@gmail.com> * Update .github/workflows/auto-version-bump-scheduler.yml Co-authored-by: Andre Wanlin <67169551+awanlin@users.noreply.github.com> Signed-off-by: Ayush More <ayushmore42595@gmail.com> * Update .github/workflows/auto-version-bump-scheduler.yml Co-authored-by: Andre Wanlin <67169551+awanlin@users.noreply.github.com> Signed-off-by: Ayush More <ayushmore42595@gmail.com> * Update .github/workflows/deprecate-archived-plugins.yml Co-authored-by: Andre Wanlin <67169551+awanlin@users.noreply.github.com> Signed-off-by: Ayush More <ayushmore42595@gmail.com> * fixed the typos Signed-off-by: Ayush More <ayushmore42595@gmail.com> * Remove helper for pinning GitHub Action digests Signed-off-by: Ayush More <ayushmore42595@gmail.com> * Fix formatting in renovate.json Signed-off-by: Ayush More <ayushmore42595@gmail.com> --------- Signed-off-by: Ayush More <ayushmore42595@gmail.com> Co-authored-by: Andre Wanlin <67169551+awanlin@users.noreply.github.com> Signed-off-by: Max Ramer <maxjramer@gmail.com>

backstage#6117) This reverts commit 0ec0afa. Signed-off-by: Andre Wanlin <awanlin@spotify.com> Signed-off-by: Max Ramer <maxjramer@gmail.com>

* feat(ci): Pin action versions to commit SHAs Signed-off-by: Ayush More <ayushmore42595@gmail.com> * Update .github/workflows/auto-version-bump-scheduler.yml Co-authored-by: Andre Wanlin <67169551+awanlin@users.noreply.github.com> Signed-off-by: Ayush More <ayushmore42595@gmail.com> * Update .github/workflows/auto-version-bump-scheduler.yml Co-authored-by: Andre Wanlin <67169551+awanlin@users.noreply.github.com> Signed-off-by: Ayush More <ayushmore42595@gmail.com> * Update .github/workflows/deprecate-archived-plugins.yml Co-authored-by: Andre Wanlin <67169551+awanlin@users.noreply.github.com> Signed-off-by: Ayush More <ayushmore42595@gmail.com> * fixed the typos Signed-off-by: Ayush More <ayushmore42595@gmail.com> * Remove helper for pinning GitHub Action digests Signed-off-by: Ayush More <ayushmore42595@gmail.com> * Fix formatting in renovate.json Signed-off-by: Ayush More <ayushmore42595@gmail.com> --------- Signed-off-by: Ayush More <ayushmore42595@gmail.com> Co-authored-by: Andre Wanlin <67169551+awanlin@users.noreply.github.com> Signed-off-by: Max Ramer <maxjramer@gmail.com>

backstage#6117) This reverts commit 0ec0afa. Signed-off-by: Andre Wanlin <awanlin@spotify.com> Signed-off-by: Max Ramer <maxjramer@gmail.com>

Ayushmore1214 · 2025-11-23T04:32:34Z

Ohhh , Thanks for getting it merged !

* feat(ci): Pin action versions to commit SHAs Signed-off-by: Ayush More <ayushmore42595@gmail.com> * Update .github/workflows/auto-version-bump-scheduler.yml Co-authored-by: Andre Wanlin <67169551+awanlin@users.noreply.github.com> Signed-off-by: Ayush More <ayushmore42595@gmail.com> * Update .github/workflows/auto-version-bump-scheduler.yml Co-authored-by: Andre Wanlin <67169551+awanlin@users.noreply.github.com> Signed-off-by: Ayush More <ayushmore42595@gmail.com> * Update .github/workflows/deprecate-archived-plugins.yml Co-authored-by: Andre Wanlin <67169551+awanlin@users.noreply.github.com> Signed-off-by: Ayush More <ayushmore42595@gmail.com> * fixed the typos Signed-off-by: Ayush More <ayushmore42595@gmail.com> * Remove helper for pinning GitHub Action digests Signed-off-by: Ayush More <ayushmore42595@gmail.com> * Fix formatting in renovate.json Signed-off-by: Ayush More <ayushmore42595@gmail.com> --------- Signed-off-by: Ayush More <ayushmore42595@gmail.com> Co-authored-by: Andre Wanlin <67169551+awanlin@users.noreply.github.com>

backstage#6117) This reverts commit 0ec0afa. Signed-off-by: Andre Wanlin <awanlin@spotify.com>

feat(ci): Pin action versions to commit SHAs

8d00b8c

Signed-off-by: Ayush More <ayushmore42595@gmail.com>

Ayushmore1214 requested a review from a team as a code owner October 19, 2025 06:28

Ayushmore1214 requested a review from BethGriggs October 19, 2025 06:28

awanlin requested changes Oct 24, 2025

View reviewed changes

Ayushmore1214 and others added 4 commits October 25, 2025 15:20

Update .github/workflows/auto-version-bump-scheduler.yml

27deb4b

Co-authored-by: Andre Wanlin <67169551+awanlin@users.noreply.github.com> Signed-off-by: Ayush More <ayushmore42595@gmail.com>

Update .github/workflows/auto-version-bump-scheduler.yml

f01e596

Co-authored-by: Andre Wanlin <67169551+awanlin@users.noreply.github.com> Signed-off-by: Ayush More <ayushmore42595@gmail.com>

Update .github/workflows/deprecate-archived-plugins.yml

4a0baf2

Co-authored-by: Andre Wanlin <67169551+awanlin@users.noreply.github.com> Signed-off-by: Ayush More <ayushmore42595@gmail.com>

fixed the typos

09d70de

Signed-off-by: Ayush More <ayushmore42595@gmail.com>

awanlin requested changes Oct 29, 2025

View reviewed changes

Comment thread .github/renovate.json Outdated

Remove helper for pinning GitHub Action digests

65f1ee1

Signed-off-by: Ayush More <ayushmore42595@gmail.com>

awanlin requested changes Nov 7, 2025

View reviewed changes

Comment thread .github/renovate.json Outdated

Fix formatting in renovate.json

70d0bd8

Signed-off-by: Ayush More <ayushmore42595@gmail.com>

awanlin approved these changes Nov 21, 2025

View reviewed changes

awanlin merged commit 0ec0afa into backstage:main Nov 21, 2025
10 checks passed

awanlin added a commit that referenced this pull request Nov 21, 2025

Revert "feat(ci): Pin action versions to commit SHAs (#5876)"

f8a4a4c

This reverts commit 0ec0afa.

awanlin mentioned this pull request Nov 21, 2025

Revert "feat(ci): Pin action versions to commit SHAs" #6117

Merged

awanlin added a commit that referenced this pull request Nov 21, 2025

Revert "feat(ci): Pin action versions to commit SHAs (#5876)"

9695fe3

This reverts commit 0ec0afa. Signed-off-by: Andre Wanlin <awanlin@spotify.com>

awanlin added a commit that referenced this pull request Nov 21, 2025

Revert "feat(ci): Pin action versions to commit SHAs (#5876)" (#6117)

05edef9

This reverts commit 0ec0afa. Signed-off-by: Andre Wanlin <awanlin@spotify.com>

Ayushmore1214 mentioned this pull request Nov 27, 2025

Org Member: Ayushmore1214 backstage/community#246

Closed

2 tasks

gavinelder pushed a commit to gavinelder/community-plugins that referenced this pull request Jan 31, 2026

Revert "feat(ci): Pin action versions to commit SHAs (backstage#5876)" (

4ebb715

backstage#6117) This reverts commit 0ec0afa. Signed-off-by: Andre Wanlin <awanlin@spotify.com>

	{
	"extends": [
	"config:best-practices",
	":gitSignOff",
	":rebaseStalePrs",
	"group:linters",
	"group:test",
	":preserveSemverRanges"
	],
	"ignorePresets": [":pinDevDependencies", ":pinDigest", "docker:pinDigests"],

Conversation

Ayushmore1214 commented Oct 19, 2025

Hey, I just made a Pull Request!

✔️ Checklist

Uh oh!

Ayushmore1214 commented Oct 19, 2025

Uh oh!

awanlin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Ayushmore1214 commented Oct 25, 2025

Uh oh!

Ayushmore1214 commented Oct 25, 2025

Uh oh!

awanlin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Ayushmore1214 commented Oct 30, 2025

Uh oh!

awanlin left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

awanlin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

awanlin commented Nov 21, 2025

Uh oh!

Ayushmore1214 commented Nov 23, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

awanlin left a comment •

edited

Loading