From eede3f919069f3531ecb74c2a6ecc529d114a603 Mon Sep 17 00:00:00 2001 From: Zack Date: Tue, 4 Aug 2026 18:32:46 +0100 Subject: [PATCH] fix(github): pin org workflow refs to a sha MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit zizmor's unpinned-uses flags these @main refs. On public repos that is reported to code scanning and exits 0, so it never blocked anything. On private repos zizmor runs in annotations mode, exits non-zero and fails the required check — correctly, since the finding is real. Pin to a devtools main sha rather than the multi-runner-build-workflow v3.1.0 tag: that tag predates #1894, so pinning to it would reintroduce the code scanning failure on private repos. terraform manages this content for every repo, so bumping the sha here propagates on apply. --- .../.github/workflows/org-pr-require-conventional-commit.yml | 2 +- .../github/org/repo-files/.github/workflows/org-zizmor.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tf/deployment/modules/shared/github/org/repo-files/.github/workflows/org-pr-require-conventional-commit.yml b/tf/deployment/modules/shared/github/org/repo-files/.github/workflows/org-pr-require-conventional-commit.yml index 5e5f84ef..ffb1fc79 100644 --- a/tf/deployment/modules/shared/github/org/repo-files/.github/workflows/org-pr-require-conventional-commit.yml +++ b/tf/deployment/modules/shared/github/org/repo-files/.github/workflows/org-pr-require-conventional-commit.yml @@ -7,6 +7,6 @@ on: jobs: validate-pr-title: name: Validate PR Title (conventional commit) - uses: immich-app/devtools/.github/workflows/shared-pr-require-conventional-commit.yml@main + uses: immich-app/devtools/.github/workflows/shared-pr-require-conventional-commit.yml@203c5d39d83e790e0a0858f6058d82ad7dc2df5d # main permissions: pull-requests: write diff --git a/tf/deployment/modules/shared/github/org/repo-files/.github/workflows/org-zizmor.yml b/tf/deployment/modules/shared/github/org/repo-files/.github/workflows/org-zizmor.yml index 050e69b4..a26a32d3 100644 --- a/tf/deployment/modules/shared/github/org/repo-files/.github/workflows/org-zizmor.yml +++ b/tf/deployment/modules/shared/github/org/repo-files/.github/workflows/org-zizmor.yml @@ -8,7 +8,7 @@ on: jobs: zizmor: name: Zizmor - uses: immich-app/devtools/.github/workflows/shared-zizmor.yml@main + uses: immich-app/devtools/.github/workflows/shared-zizmor.yml@203c5d39d83e790e0a0858f6058d82ad7dc2df5d # main permissions: actions: read contents: read