From c2ab4fe9736289f4a62df865a10c274a4ec6eed9 Mon Sep 17 00:00:00 2001 From: Lane Sawyer Date: Thu, 9 Jul 2026 06:28:59 -0700 Subject: [PATCH] ci(actions): SHA-pin remaining workflow actions (#8868) * ci(actions): SHA-pin remaining workflow actions Replace the mutable derekprior/add-autoresponse@master ref in issue-open-auto-reply.yml with an inline actions/github-script snippet to remove the third-party code-injection risk in CI. SHA-pin the 4 remaining tag-pinned actions in wiki-sync.yml (checkout, setup-python) to match the rest of the workflows. Co-Authored-By: Claude Opus 4.8 * wrong sha for the github-script v9 --------- Co-authored-by: Claude Opus 4.8 --- .github/workflows/issue-open-auto-reply.yml | 28 +++++++++++++++------ .github/workflows/wiki-sync.yml | 8 +++--- 2 files changed, 25 insertions(+), 11 deletions(-) diff --git a/.github/workflows/issue-open-auto-reply.yml b/.github/workflows/issue-open-auto-reply.yml index 359d9c9b1b..d282ca10e0 100644 --- a/.github/workflows/issue-open-auto-reply.yml +++ b/.github/workflows/issue-open-auto-reply.yml @@ -12,11 +12,25 @@ jobs: runs-on: ubuntu-latest steps: - - uses: derekprior/add-autoresponse@master - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: - respondableId: ${{ github.event.issue.node_id }} - response: "Thank you very much for opening up this issue! I am currently a bit overwhelmed by the many requests that arrive each week, so please forgive me, if I fail to respond personally. I am still very likely to at least skim read your request and I'll probably try to fix all (real) bugs if possible and I will likely review every single PR being made (please, give me a heads up if you intent to do so) and I will try to work on popular requests (please upvote via thumbs up on the original issue) whenever possible, but trying to respond to every single issue over the last years has been kind of draining and I need to adjust my approach for this project to remain fun for me and to make any progress with actually coding new stuff. Thanks for your understanding!" - author: ${{ github.event.issue.user.login }} - exemptedAuthors: 'johannesjo' + script: | + const exemptedAuthors = ['johannesjo']; + if (!context.payload.issue) { + core.warning("No issue payload found. This likely indicates this Action is misconfigured."); + return; + } + + const author = context.payload.issue.user.login; + if (exemptedAuthors.includes(author)) { + core.info(`Author ${author} is exempted; skipping auto-response.`); + return; + } + + const response = "Thank you very much for opening up this issue! I am currently a bit overwhelmed by the many requests that arrive each week, so please forgive me, if I fail to respond personally. I am still very likely to at least skim read your request and I'll probably try to fix all (real) bugs if possible and I will likely review every single PR being made (please, give me a heads up if you intent to do so) and I will try to work on popular requests (please upvote via thumbs up on the original issue) whenever possible, but trying to respond to every single issue over the last years has been kind of draining and I need to adjust my approach for this project to remain fun for me and to make any progress with actually coding new stuff. Thanks for your understanding!"; + await github.rest.issues.createComment({ + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: context.payload.issue.number, + body: response, + }); diff --git a/.github/workflows/wiki-sync.yml b/.github/workflows/wiki-sync.yml index 78276d3463..363155e39d 100644 --- a/.github/workflows/wiki-sync.yml +++ b/.github/workflows/wiki-sync.yml @@ -32,10 +32,10 @@ jobs: steps: - name: Checkout Code - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.13' @@ -82,7 +82,7 @@ jobs: steps: - name: Checkout Code - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: repository: ${{ github.repository }} path: ${{ env.CODE_ROOT }} @@ -92,7 +92,7 @@ jobs: # includeIf matcher, which intermittently leaves the wiki push without # credentials on github-hosted runners (run 26335467138). v5 uses the # path-independent extraheader and is stable for this second checkout. - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: repository: ${{ github.repository }}.wiki path: ${{ env.WIKI_ROOT }}