[release/v7.4.15] [StepSecurity] ci: Harden GitHub Actions tags by daxian-dbw · Pull Request #27241 · PowerShell/PowerShell

daxian-dbw · Apr 9, 2026

Backport of #27201 to release/v7.4.15

Triggered by @daxian-dbw on behalf of @step-security-bot

Original CL Label: CL-BuildPackaging

/cc @PowerShell/powershell-maintainers

Impact

REQUIRED: Choose either Tooling Impact or Customer Impact (or both). At least one checkbox must be selected.

Tooling Impact

Required tooling change
Optional tooling change (include reasoning)

Pins mutable GitHub Action tags to immutable SHA references across CI and reusable workflow definitions on release/v7.4.15, reducing supply-chain risk in the release automation path.

Customer Impact

Customer reported
Found internally

Regression

REQUIRED: Check exactly one box.

Yes
No

This is not a regression.

Testing

The backport cherry-pick completed on top of the updated release/v7.4.15 branch after resolving workflow conflicts. The resolved files keep the PR's SHA-pinned action references in the conflicted locations while preserving release-branch-specific workflow structure. CI on the backport PR will validate the affected build, test, and workflow paths.

Risk

REQUIRED: Check exactly one box.

High
Medium
Low

Medium risk because the change touches a broad set of CI and reusable workflow definitions, but the edits are limited to action reference pinning and preserve the existing release-branch workflow behavior.

Merge Conflicts

Resolved conflicts in labels.yml, linux-ci.yml, macos-ci.yml, verify-markdown-links.yml, windows-ci.yml, windows-packaging-reusable.yml, and xunit-tests.yml by preserving the release/v7.4.15 workflow structure and accepting the PR's SHA-pinned action references where the conflicts occurred. File endings were preserved with trailing newlines.

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>

Copilot

Pull request overview

Backport of StepSecurity hardening to release/v7.4.15, updating GitHub Actions/workflow references to use immutable commit SHAs to reduce supply-chain risk in CI and reusable workflows.

Changes:

Replaces multiple uses: org/action@v* references with uses: org/action@<full_sha> # vX.Y.Z.
Updates common CI workflows (Linux/macOS/Windows) and reusable workflows to use SHA-pinned actions/checkout and actions/setup-dotnet.
Pins several composite action dependencies (download-artifact, upload-artifact, github-script) to SHAs.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 12 comments.

Show a summary per file

File	Description
.github/workflows/xunit-tests.yml	Pins `checkout`/`.NET setup` action references for reusable xUnit workflow.
.github/workflows/windows-packaging-reusable.yml	Pins `checkout`/`.NET setup` action references for reusable Windows packaging workflow.
.github/workflows/windows-ci.yml	Pins `checkout` action references across Windows CI jobs; minor formatting adjustment in `ready_to_merge` inputs.
.github/workflows/verify-markdown-links.yml	Pins `checkout` for markdown link verification workflow.
.github/workflows/macos-ci.yml	Pins `checkout` across macOS CI jobs and pins `.NET setup` in packaging section.
.github/workflows/linux-ci.yml	Pins `checkout` across Linux CI jobs.
.github/workflows/labels.yml	Pins `checkout` and `github-script` used for PR label validation workflow.
.github/workflows/copilot-setup-steps.yml	Pins `checkout` for Copilot setup workflow.
.github/workflows/analyze-reusable.yml	Pins `setup-dotnet` in CodeQL reusable workflow.
.github/actions/test/windows/action.yml	Pins artifact download and `.NET setup` used in Windows test composite action.
.github/actions/test/process-pester-results/action.yml	Pins artifact upload used for publishing Pester results.
.github/actions/test/nix/action.yml	Pins artifact download, `.NET setup`, and `github-script` used in non-Windows test composite action.
.github/actions/test/linux-packaging/action.yml	Pins `.NET setup` and artifact uploads in Linux packaging composite action.
.github/actions/infrastructure/path-filters/action.yml	Pins `github-script` used in path filter composite action.
.github/actions/infrastructure/get-changed-files/action.yml	Pins `github-script` used to enumerate changed files.
.github/actions/build/ci/action.yml	Pins `.NET setup` and artifact upload in CI build composite action.

Copilot · Apr 9, 2026

    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2


This change isn’t only pinning the existing actions/checkout tag; it also changes the referenced version from @v4 to a SHA labeled v6.0.2 (major bump). For a release-branch backport, consider pinning the SHA for the same major version previously used (or explicitly call out the intentional major upgrade in the PR description).

Suggested change

uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

Copilot · Apr 9, 2026


      - name: Setup .NET
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0


This updates actions/setup-dotnet from @v4 to a SHA labeled v5.2.0 (major version change). If the goal is strictly tag hardening, pin the SHA for the previously used major version to avoid unexpected behavior changes on the release branch.

Suggested change

uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0

uses: actions/setup-dotnet@v4

Copilot · Apr 9, 2026

    steps:
      - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2


This actions/checkout update changes from @v5 to a SHA labeled v6.0.2 (major bump). If the intent is only to pin, consider using the SHA for the existing major version to minimize workflow behavior changes on a release branch.

Suggested change

uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

Copilot · Apr 9, 2026


      - name: Setup .NET
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0


This changes actions/setup-dotnet from @v4 to a SHA labeled v5.2.0 (major version change). If you want this PR to be a pure hardening backport, pin to the SHA for the existing v4.x release instead; otherwise document the intentional upgrade and verify it against global.json/tooling expectations for this branch.

Suggested change

uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0

uses: actions/setup-dotnet@v4

Copilot · Apr 9, 2026

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2


This changes actions/checkout from @v4 to a SHA labeled v6.0.2 (major bump). If the objective is only to pin tags, consider pinning the SHA for the same major version previously used to avoid unexpected workflow behavior changes.

Suggested change

uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

Copilot · Apr 9, 2026

    steps:
      - name: checkout
-        uses: actions/checkout@v4.1.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2



This updates actions/checkout from @v4.1.0 to a SHA labeled v6.0.2 (major bump). For a release-branch backport intended to pin tags, consider pinning to the SHA for the same major/minor version previously used (or document the intentional major upgrade).

Copilot · Apr 9, 2026

      with:
        fetch-depth: 1000
-    - uses: actions/setup-dotnet@v4
+    - uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0


This step changes actions/setup-dotnet from @v4 to a SHA labeled v5.2.0 (major version change). If the goal is tag hardening only, pin to a v4.x SHA instead to avoid behavior changes in release-branch packaging.

Suggested change

- uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0

- uses: actions/setup-dotnet@3a4f6e1af504cf6a31855e1d347c7c1f6df7b3a5 # v4.1.0

Copilot · Apr 9, 2026

    steps:
      - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false


This updates actions/checkout from @v4 to a SHA labeled v6.0.2 (major bump). For a release-branch backport that’s meant to harden tags, prefer pinning the SHA for the same major version previously used (or explicitly justify the major upgrade).

Copilot · Apr 9, 2026

    steps:
    - name: Check out the repository
-      uses: actions/checkout@v2
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2


This changes actions/checkout from @v2 to a SHA labeled v6.0.2 (major bump). If the intention is only to pin tags, pin to the SHA for the previously used major version to reduce the chance of workflow behavior changes on this release branch.

Suggested change

uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

uses: actions/checkout@v2

Copilot · Apr 9, 2026

    - name: Verify PR has label starting with 'cl-'
      id: verify-labels
-      uses: actions/github-script@v6
+      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0


This updates actions/github-script from @v6 to a SHA labeled v8.0.0 (major bump). If the goal is strictly action pinning, pin to a SHA for the existing major version instead; otherwise note the intentional major upgrade and confirm compatibility with the current script API surface.

Suggested change

uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0

uses: actions/github-script@v6

[StepSecurity] ci: Harden GitHub Actions (PowerShell#27201)

829c0b0

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>

daxian-dbw added the CL-BuildPackaging Indicates that a PR should be marked as a build or packaging change in the Change Log label Apr 9, 2026

Copilot AI review requested due to automatic review settings April 9, 2026 20:41

daxian-dbw requested a review from a team as a code owner April 9, 2026 20:41

Copilot started reviewing on behalf of daxian-dbw April 9, 2026 20:42 View session

daxian-dbw closed this Apr 9, 2026

Copilot AI reviewed Apr 9, 2026

View reviewed changes

daxian-dbw deleted the backport/release/v7.4.15/27201-34375e905 branch April 9, 2026 20:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[release/v7.4.15] [StepSecurity] ci: Harden GitHub Actions tags#27241

daxian-dbw commented Apr 9, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

	uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
	uses: actions/setup-dotnet@v4

	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

	- uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
	- uses: actions/setup-dotnet@3a4f6e1af504cf6a31855e1d347c7c1f6df7b3a5 # v4.1.0

	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	uses: actions/checkout@v2

	uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
	uses: actions/github-script@v6

Search code, repositories, users, issues, pull requests...

Conversation

daxian-dbw commented Apr 9, 2026

Impact

Tooling Impact

Customer Impact

Regression

Testing

Risk

Merge Conflicts

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants