Pin third-party CI actions to commit hashes
Floating tags on third-party pipeline actions replaced with commit hashes, so a moved tag cannot change what runs.
The ticket
Replace floating version tags on third-party CI actions with pinned commit hashes.
Acceptance criteria
- Every third-party action is referenced by a full commit hash
- The version each hash corresponds to is recorded in a comment beside it
- The pipeline runs green after the change
- First-party actions inside this organisation are left as they are
What lands as proof
The workflow diff showing hashes with their version comments, and a green run on the pinned set.
Why teams defer it
- A moved tag silently changes what runs in the pipeline, which is the kind of risk that only becomes visible after it has been exploited somewhere else.
- It touches pipeline files, so it needs an approver who understands the pipeline, and that person is usually the busiest one.
Questions
- What does the agent actually change?
- The ticket is scoped to one outcome: replace floating version tags on third-party CI actions with pinned commit hashes. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.
- How do I know the work is done?
- The pull request carries the evidence, not only the diff. Here that means pipeline edits pause for approval, timings unchanged, so a reviewer can confirm the result without reproducing the work locally.
- How much oversight does this need?
- The run stops for the plan, and the review bar is raised afterwards so that smaller suggestions block the merge too, not only serious findings.