Pin GitHub Actions to commit SHAs #5643

Activity

1. github-project-automation

   added this to .NET Source Buildon Aug 19, 2026
2. github-project-automation

   moved this to Backlog in .NET Source Buildon Aug 19, 2026
3. github-actions

   added

   untriaged

   on Aug 19, 2026
4. github-actions commented on Aug 19, 2026

   

   github-actionsbot

   on Aug 19, 2026 – with GitHub Actions

   More actions

   🏷️ Source-build triage pass — 2026-08-19 23:08 UTC

   📋 Classification

   Field	Value
   Area	area-infra
   Additional area(s)	none
   Kind	feature-request
   Severity	S3 — supply-chain security improvement; no broken scenario today, but unpinned actions are a known security risk
   Affected version(s)	current
   Repro	n/a — feature request, not a bug

   🚦 Priority

   • Blocking: not blocking
   • Urgency: ⚪ backlog — no milestone

     Security best practice improvement; no active exploit or blocked scenario, can be addressed at next available capacity.

   👥 Routing

   • Team: @dotnet/source-build
   • Possible SME(s): mthalman, ellahathaway
     • mthalman — issue author; active on infra and release pipeline issues (e.g., Feature band release PRs timing issue #5636, Indicate rebootstrap requirements in source-build release announcements #5639)
     • ellahathaway — active contributor on infra and CI issues in recent months

   🔗 Cross-references

   • Recommended labels: add area-infra
   • Related issues: none found
   • Possible duplicate of: none

   ✅ Assessment

   • Confidence: high
   • Needs human?: no

   ---

   Restricted mode — no labels or milestone applied. A maintainer should manually apply any accepted labels and milestone.

   Generated by Triage · 65.7 AIC · ⌖ 11.1 AIC · ⊞ 24.6K · ◷
5. mthalman

   added

   area-buildImprovements in source-build's own build processImprovements in source-build's own build process

   and removed

   untriaged

   on Aug 20, 2026
6. mthalman

   assigned

   Copilot

   and

   mthalman

   on Aug 20, 2026
7. Copilot

   linked a pull request that will close this issuePin GitHub Actions to immutable SHAs and enable Dependabot-managed SHA refresh #5644on Aug 20, 2026
8. mthalman

   closed this as completedin #5644on Aug 20, 2026
9. github-project-automation

   moved this from Backlog to Done in .NET Source Buildon Aug 20, 2026