[grace-hopper-day] Pin Github Actions by commit-hash - nodejs/diagnostics

[RafaelGSS]

Pin Actions to a full length commit SHA

Repository: https://github.com/nodejs/diagnostics

Why is this needed?

• GitHub Action tags and Docker tags are mutable, which poses a security risk
• If the tag changes you will not have a chance to review the change before it gets used
• GitHub's Security Hardening for GitHub Actions guide recommends pinning actions to full length commit for third party actions.

Before and After the fix

Before the fix, your workflow may look like this (use of v1 and latest tags)

After the fix, Secure-Repo pins each Action and docker image to an immutable checksum.

Pull request example: electron/electron#36343

In this pull request, the workflow file has the GitHub Actions tags pinned automatically to their full-length commit SHA.

---

From: https://github.com/step-security/secure-repo#3-pin-actions-to-a-full-length-commit-sha