Ergonomic, hermetic, user-friendly software build system for Python, Go, Java, Kotlin, Protobuf, Scala, Shell. Pants lets you fearlessly scale up your codebase!

Pants

Does anyone have any objections for me SHA pinning 3rd party Github Actions following Github's advice? <https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions>

I personally can't think of objections. Given how stringent our subsystems are with downloading with SHA/size checks, feels like that methodology should propagate throughout the system including CI

Screenshot 2025-11-03 at 09.41.45.png

Turns out we can really up the game here and enforce SHA pinning for all actions. My plan right now was to version pin the github core actions, and then SHA pin the external ones - but we could just enforce everything is pinned and call it a day :shrug:

Once I remove the generate_github_workflows - we'd be relying on dependabot to update these anyways, so kicking this question down the line

<https://github.com/pantsbuild/pants/issues/22755#issuecomment-3480915698> Noted here