[TASK] Pin the GH action releases

[oliverklee]

https://docs.zizmor.sh/audits/#unpinned-uses

Part of #1650

[coveralls]

coverage: 98.176%. remained the same — task/pin-actions into main

[JakeQZ]

Can the uses not be pinned by a specific version tag? This would make it clearer and less error-prone than using the SHA, simpler to maintain, and allow Dependabot to update the tools (unless it can handle maintaining pins by SHA).

[JakeQZ]

Suggested change

	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	uses: actions/checkout@v7.0.1

[JakeQZ]

Suggested change

	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	uses: actions/checkout@v7.0.1

[JakeQZ]

Suggested change

	uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2
	uses: shivammathur/setup-php@v2.37.2

[JakeQZ]

Suggested change

	uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2
	uses: shivammathur/setup-php@v2.37.2

[JakeQZ]

Suggested change

	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	uses: actions/checkout@v7.0.1

[JakeQZ]

Suggested change

	uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2
	uses: shivammathur/setup-php@v2.37.2

[JakeQZ]

Suggested change

	uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
	uses: actions/cache@v6.1.0

[JakeQZ]

Suggested change

	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	uses: actions/checkout@v7.0.1

[JakeQZ]

Suggested change

	uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
	uses: actions/cache@v6.1.0

[JakeQZ]

Suggested change

	uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2.3.8
	uses: coverallsapp/github-action@v2.3.8

[oliverklee]

Can the uses not be pinned by a specific version tag? This would make it clearer and less error-prone than using the SHA, simpler to maintain, and allow Dependabot to update the tools (unless it can handle maintaining pins by SHA).

AFAIK, Dependabot can also update hash-pinned action versions.

Pinning to specific versions only protects against installing new/higher compromised versions of actions. That's what the cooldown period for Dependabot mostly protects against (as compromised versions usually get taken down within a few days).

Pinning to commit hashes protects against this scenario:

1. A repository of a GH action does not have immutable releases enabled.
2. That repository (or the account of one of the maintainers) gets compromised.
3. The attacker then removes an existing release and replaces it with a modified version containing malicious code.
4. Other repositories that use that particular version of the action then will happily install and run the compromised action.

Depending on the permissions of the compromised account, the attacker also could disable immutable releases for the attacked repo.