Pin Process-PSModule workflow reference to immutable SHA#6
Merged
Marius Storhaug (MariusStorhaug) merged 1 commit intomainfrom Apr 5, 2026
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Pins the reusable Process-PSModule GitHub Actions workflow to an immutable commit SHA to reduce supply-chain risk and align with the repo’s convention for uses: references.
Changes:
- Updated
.github/workflows/Process-PSModule.ymlto referencePSModule/Process-PSModuleby commit SHA instead of mutable@v5 - Added an inline comment indicating the corresponding version (
v5.4.5)
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| jobs: | ||
| Process-PSModule: | ||
| uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@v5 | ||
| uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@4343d76f9e8c9468527175ea292092c2d055be8c # v5.4.5 |
There was a problem hiding this comment.
Commit-SHA pinning is good, but inline version comments can become stale if the SHA is updated without updating # v5.4.5. To avoid drift, consider either (a) removing the version comment, or (b) adding a lightweight check (e.g., in CI or a scheduled job) that verifies the comment matches the referenced commit/tag.
Suggested change
| uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@4343d76f9e8c9468527175ea292092c2d055be8c # v5.4.5 | |
| uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@4343d76f9e8c9468527175ea292092c2d055be8c |
Marius Storhaug (MariusStorhaug)
deleted the
fix/pin-process-psmodule-sha
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The CI workflow reference is now pinned to a specific commit SHA, consistent with all other
uses:references in the PSModule infrastructure. Dependabot will automatically propose updates when new versions of Process-PSModule are released.Changed: Workflow reference pinned to immutable SHA
The
Process-PSModulereusable workflow reference in.github/workflows/Process-PSModule.ymlwas using a mutable major version tag (@v5). It is now pinned to the exact commit SHA with the patch-level version in a trailing comment:Dependabot's
github-actionsecosystem is already configured and will keep this reference up to date automatically.