Pin third-party action to immutable ref in release workflow

[robnester-rh]

Summary

• Pinned jlumbroso/free-disk-space from mutable @main to immutable SHA @54081f138730dfa15788a46383842cd2f914a1be (v1.3.1). This action runs in a job with contents: write, pages: write, and id-token: write permissions — a compromised upstream pushing to main could sign and publish arbitrary releases. CVSS 8.0.

• Re-enabled step-security/harden-runner at v2.20.1 (was commented out at v2.4.1). The original concern was disk space exhaustion, but free-disk-space now reclaims ~30GB before subsequent steps run. In egress-policy: audit mode, harden-runner monitors network egress without blocking — low risk, high visibility into what the release job contacts.

• Added helpers:pinGitHubActionDigests to renovate.json. This Renovate preset does two things: (1) automatically opens PRs to pin any future actions added with a mutable tag ref (e.g. @v3) to their full SHA digest, and (2) keeps existing SHA-pinned actions up to date when new versions are released. This is scoped to cli only — it extends the shared org config without modifying it, so it can be promoted to conforma/.github later if the team wants org-wide coverage.

Test plan

• Verify release workflow runs successfully (harden-runner + free-disk-space don't exhaust disk)
• Confirm Renovate picks up the new preset and doesn't produce config errors
• Check harden-runner audit output appears in the workflow logs

Resolves: EC-2045

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 412d0fee-0472-4504-9fa3-031511bca4b0

📥 Commits

Reviewing files that changed from the base of the PR and between a915bcf and 957f59e.

📒 Files selected for processing (2)

• .github/workflows/release.yaml
• renovate.json

---

📝 Walkthrough

Walkthrough

The release workflow now enables runner hardening and pins action revisions. Renovate now applies the GitHub Actions digest-pinning preset.

Changes

Release security configuration

Layer / File(s)	Summary
Release action pinning .github/workflows/release.yaml, renovate.json	The workflow enables step-security/harden-runner with audit egress policy and disabled telemetry. It pins the hardening and disk-space actions to commit revisions. Renovate now applies the GitHub Actions digest-pinning helper.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: cuipinghuo

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description explains what changed, why it changed, and links ticket EC-2045; it also includes a test plan.
Title check	✅ Passed	The title clearly identifies the primary change: pinning a third-party action to an immutable reference in the release workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:35 PM UTC · Completed 3:46 PM UTC
Commit: 87c4a29 · View workflow run →

[qodo-for-conforma]

PR Summary by Qodo

Pin GitHub Actions to SHA digests and re-enable harden-runner in release

⚙️ Configuration changes ✨ Enhancement 🕐 10-20 Minutes

AI Description

• Re-enable step-security/harden-runner in audit mode for release job egress visibility.
• Pin jlumbroso/free-disk-space from @main to an immutable SHA digest.
• Configure Renovate to auto-pin and keep GitHub Action digests updated.

Diagram

graph TD
  A["Release workflow"] --> B["Harden Runner action"] --> C["Free Disk Space action"] --> D["Release publish steps"]
  E["renovate.json"] --> F["Renovate bot"] --> G["Action digest pin PRs"]
  G --> A

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use version tags only (e.g., @v2/@v1.3.1)

• ➕ More readable than full SHAs
• ➕ Less churn in diffs when upstream repoints tags intentionally
• ➖ Does not protect against tag retargeting or compromised maintainers
• ➖ Weaker supply-chain posture than digest pinning

2. Enforce harden-runner allowlist (egress-policy: block)

• ➕ Stronger containment if the job or an action is compromised
• ➕ Makes unexpected network access fail fast
• ➖ Higher risk of breaking releases without a maintained allowlist
• ➖ More operational overhead to keep endpoints current

3. Move Renovate helper preset to org-level shared config

• ➕ Org-wide coverage with consistent policy
• ➕ Less per-repo maintenance
• ➖ Harder to roll out safely across all repositories at once
• ➖ Requires coordination/approval for shared-config changes

Recommendation: Keep the current approach: SHA-pin third-party actions and enable harden-runner in audit mode, with Renovate enforcing future pinning. Digest pinning is the strongest practical mitigation for action supply-chain risk, and audit-mode harden-runner provides immediate visibility with minimal release-risk. Consider moving the Renovate preset to org config later once this repo’s behavior is validated.

Files changed (2) +8 / -8

Other (2) +8 / -8

release.yamlRe-enable harden-runner and pin free-disk-space to SHA digest +6/-7

Re-enable harden-runner and pin free-disk-space to SHA digest

• Uncomments and upgrades step-security/harden-runner, running it in egress audit mode with telemetry disabled. Replaces jlumbroso/free-disk-space@main with an immutable SHA digest (v1.3.1) to avoid mutable-ref supply-chain risk.

.github/workflows/release.yaml

renovate.jsonEnable Renovate helper to pin and update GitHub Action digests +2/-1

Enable Renovate helper to pin and update GitHub Action digests

• Extends the Renovate configuration with helpers:pinGitHubActionDigests so new actions are pinned to SHAs and existing pinned actions are kept up to date.

renovate.json

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.41% <ø> (+<0.01%)	⬆️
generative	16.36% <ø> (ø)
integration	27.58% <ø> (ø)
unit	71.97% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

Review

Findings

High

• [protected-path] .github/workflows/release.yaml — This PR modifies files under the .github/ protected path. The PR references EC-2045 (an internal tracker) but does not link to a GitHub issue. Changes to governance and infrastructure files require human approval regardless of context. Affected protected files: .github/workflows/release.yaml.
  Remediation: Link to a GitHub issue authorizing the change, or obtain human approval from a code owner.

Low

• [consistency] .github/workflows/release.yaml:69 — The harden-runner SHA in this PR (b09bb98e06d4d774595224525879c09bc6e98c40, v2.20.1) differs from the SHA used in all other workflows in the repository (bf7454d06d71f1098171f2acdf0cd4708d7b5920, v2.20.0). This creates a temporary version skew across workflows. The newly added helpers:pinGitHubActionDigests Renovate preset should eventually reconcile this by proposing an update for the other workflows, but until that Renovate PR is merged, the release workflow will run a different harden-runner version than other workflows.

---

Labels: PR modifies GitHub Actions workflow files and Renovate configuration for action digest pinning

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-review]

See the review comment for full details.

[robnester-rh]

Regarding the fullsend protected-path finding: this PR intentionally modifies .github/workflows/release.yaml to address a CVSS 8.0 supply-chain security finding (EC-2045). The change pins a third-party action to an immutable SHA and re-enables harden-runner. Human approval from a code owner is expected and requested (Simon is tagged as reviewer).