Skip to content

ci: use a maintained commitlint action fork #20

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
robinbowes merged 1 commit into from
Aug 11, 2026
Merged

ci: use a maintained commitlint action fork #20

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,11 @@ jobs:
with:
fetch-depth: 0
persist-credentials: false
- uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6.2.1
# Fork of wagoid/commitlint-github-action. Upstream is unmaintained: no
# commit to master since 2025-01-14, and it pins @commitlint/ensure ^19,
# two majors behind. This fork runs commitlint v21 on node 24, and pins its
# runtime image by digest so the SHA pin here cannot be worked around.
- uses: yo61/commitlint-github-action@501ff7bb31eb7133c871318c877d0e43cd1ff500 # v6.3.0 (digest-pinned)
with:

@yo61-lastlight yo61-lastlight Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[Important] SHA pin still doesn't cover the executed artifact — fork's action.yml runs a mutable Docker tag

Unchanged from the last review: the git-SHA pin on yo61/commitlint-github-action@31e5e045... only fixes which action.yml gets read. That file declares runs.using: docker with image: docker://ghcr.io/yo61/commitlint-github-action:6.3.0 (confirmed by fetching action.yml at this exact SHA) — a registry tag, not a digest. GitHub Actions pulls that pre-built image from ghcr.io at run time, so if tag 6.3.0 is ever repushed, every CI run using this SHA-pinned reference silently executes different code with no diff to review. Since this PR's stated purpose is tightening the commitlint pipeline's supply-chain hygiene, pinning the fork's action.yml to ghcr.io/yo61/commitlint-github-action@sha256:... would close the gap.

configFile: commitlint.config.mjs

Expand Down