chore(ci): update check-permissions action to pull latest - #8437

🌐 Web query:

What do GitHub Actions security best practices recommend for reusable workflow uses:references: pinning by branch/tag (e.g.,@main) vs full commit SHA?

💡 Result:

Best practice: prefer pinning reusable workflow uses: references to a full-length commit SHA over pinning to a branch/tag like @main (or @v1). Pinning to a full-length commit SHA is GitHub’s recommended way to make the referenced code effectively immutable, and it’s the only approach GitHub states provides immutable “release” semantics for Actions. [1] What GitHub recommends about branch/tag pins vs commit SHAs 1) Pin to full-length commit SHA for immutability - GitHub docs state: “Pinning an action to a full-length commit SHA is currently the only way to use an action as an immutable release.” [1] - GitHub further explains SHA pinning mitigates risk from a bad actor adding backdoor code to the action’s repository, because they would need to generate a SHA-1 collision for a valid Git object payload. [1] - GitHub also supports enforcing SHA pinning via policy; if a workflow attempts to use an action that isn’t pinned to a full-length SHA, the workflow fails. [2] 2) Pin to a tag only if you trust the creator (and still accept residual risk) - GitHub notes pinning to a tag is more convenient and widely used, but cautions: “Pin actions to a tag only if you trust the action’s creators.” [1] - GitHub adds that tag risk remains even if you trust the author, because a tag “can be moved or deleted” if an attacker gains access to the action’s repository. [1] How this maps specifically to reusable workflows (uses: owner/repo/.github/workflows/...@...) - GitHub’s enterprise policy documentation states: “Require actions to be pinned to a full-length commit SHA… Reusable workflows can still be referenced by tag.” [3] - That implies GitHub recognizes (and policy enforcement may not yet fully constrain) reusable workflows differently than standard Actions. Nevertheless, GitHub also explicitly links reusable-workflow security to the same “good practices” as for third-party workflows. [1] - GitHub’s reusable-workflow configuration docs also state the same conditional guidance: using a commit SHA ensures everyone always uses the same YAML, while tags/branches require trust in that version. [4] Answer to your specific question (pin by branch/tag like @main vs full commit SHA) - If you want the strongest supply-chain and immutability properties: pin the reusable workflow reference to a full-length commit SHA, not @main/tags. [1][4] - If you must use tags/branches: treat that as a weaker control that depends on your trust in the workflow publisher, and understand that tags/branches are mutable and can be moved or deleted (creating a risk window). [1][4] Practical guidance - Prefer: uses: OWNER/REPO/.github/workflows/workflow.yml@<full-commit-sha>. - Avoid: uses: OWNER/REPO/.github/workflows/workflow.yml@main for security-hardening contexts, because it follows a moving reference rather than an immutable one. (GitHub’s immutability guidance is tied to full commit SHAs, while tag/branch references depend on trust and mutability risks.) [1][4]

Citations:

• 1: https://docs.github.com/en/actions/reference/security/secure-use
• 2: https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/
• 3: https://githubdocs.cn/en/enterprise-cloud@latest/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise
• 4: https://github.com/github/docs/blob/main/content/actions/concepts/workflows-and-actions/reusing-workflow-configurations.md

🏁 Script executed:

#!/bin/bash
set -euo pipefail
FILE=".github/workflows/pr-preview.yml"
if [ -f "$FILE" ]; then
  echo "== $FILE =="
  nl -ba "$FILE" | sed -n '1,40p'
else
  echo "File not found: $FILE" >&2
  exit 1
fi

Repository: patternfly/patternfly

Length of output: 166

🏁 Script executed:

#!/bin/bash
set -euo pipefail
FILE=".github/workflows/pr-preview.yml"
if [ -f "$FILE" ]; then
  echo "== $FILE (lines 1-25) =="
  cat -n "$FILE" | sed -n '1,25p'
else
  echo "File not found: $FILE" >&2
  exit 1
fi

Repository: patternfly/patternfly

Length of output: 1092