Skip to content

ci(deps): bump actions/cache from 4 to 6 #5614

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
proggeramlug merged 1 commit into from
Jun 24, 2026
Merged

ci(deps): bump actions/cache from 4 to 6 #5614

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/benchmark.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ jobs:
uses: dtolnay/rust-toolchain@stable

- name: Cache cargo
uses: actions/cache@v5
uses: actions/cache@v6

@coderabbitai coderabbitai Bot Jun 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify all cache uses and whether they are SHA-pinned.
fd -t f -e yml .github/workflows | xargs rg -n 'uses:\s*actions/cache@'

echo
echo "Pinned (40-char SHA) references:"
fd -t f -e yml .github/workflows | xargs rg -n 'uses:\s*actions/cache@[0-9a-f]{40}'

echo
echo "Resolve current commit SHA behind major tag v6:"
gh api repos/actions/cache/commits/v6 --jq .sha

Repository: PerryTS/perry

Length of output: 1222

🏁 Script executed:

# First, check if the file exists and view it
if [ -f ".github/workflows/benchmark.yml" ]; then
  echo "File exists. Viewing lines around 48 and 213:"
  echo "=== Lines 40-56 (around line 48) ==="
  sed -n '40,56p' .github/workflows/benchmark.yml
  echo
  echo "=== Lines 205-220 (around line 213) ==="
  sed -n '205,220p' .github/workflows/benchmark.yml
  echo
  echo "=== All cache references in file ==="
  grep -n "actions/cache@" .github/workflows/benchmark.yml
else
  echo "File not found. Listing .github/workflows directory:"
  ls -la .github/workflows/
fi

Repository: PerryTS/perry

Length of output: 1302

Pin actions/cache to an immutable commit SHA.

Lines 48 and 213 both use the mutable tag @v6 instead of a pinned commit SHA. This leaves the workflow vulnerable to tag-retarget supply-chain attacks. Pin both references to the full 40-character commit SHA: 2c8a9bd7457de244a408f35966fab2fb45fda9c8

Suggested change 
-        uses: actions/cache@v6
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
uses: actions/cache@v6
uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6
🧰 Tools
🪛 zizmor (1.26.1)

[error] 48-48: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

[error] 48-48: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default

(cache-poisoning)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/benchmark.yml at line 48, The workflow uses a mutable
version tag `@v6` for the actions/cache action on line 48 (and also on line 213),
which creates a supply-chain attack vulnerability. Replace both instances of
actions/cache@v6 with actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 to
pin the action to a specific immutable commit SHA instead of the mutable tag.

Source: Linters/SAST tools

with:
path: |
~/.cargo/registry
Expand Down Expand Up @@ -210,7 +210,7 @@ jobs:
uses: dtolnay/rust-toolchain@stable

- name: Cache cargo
uses: actions/cache@v5
uses: actions/cache@v6
with:
path: |
~/.cargo/registry
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/cache-warm.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ jobs:
# (`sccache-<os>-perry-`). This runs on main, so the saved entry is
# main-scoped → restorable by every PR. run_id keeps the key unique.
- name: Cache sccache objects
uses: actions/cache@v4
uses: actions/cache@v6

@coderabbitai coderabbitai Bot Jun 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

cat -n .github/workflows/cache-warm.yml | head -100

Repository: PerryTS/perry

Length of output: 5116

🏁 Script executed:

rg "actions/cache" --type yaml -B 2 -A 2

Repository: PerryTS/perry

Length of output: 151

🌐 Web query:

GitHub Actions pinning to commit SHA supply chain security best practices

💡 Result:

Pinning GitHub Actions to a full-length commit SHA is a critical supply chain security practice that mitigates the risk of malicious code injection via mutable references like tags or branch names [1][2][3]. Why Pinning is Essential GitHub Actions referenced by tags (e.g., @v4) or branches (e.g., @main) are mutable, meaning a maintainer—or an attacker who compromises an action's repository—can force-update these references to point to different, potentially malicious code [4][5][6]. Once a tag is retargeted, every workflow using that tag will automatically execute the new code, exposing CI/CD environments and secrets [2][7][3]. Pinning to a full-length (40-character) commit SHA provides immutability: the SHA cryptographically binds the workflow to a specific, reviewable point in the action's history, ensuring the exact same code runs every time [4][5][8]. Best Practices for Implementation 1. Use Full-Length SHAs: Always use the full 40-character commit SHA, never short SHAs [7][9]. This ensures the reference is uniquely tied to the specific commit object [4][10]. 2. Maintain Human-Readable Tags: Include the original version tag as a comment in your YAML file [2][3]. Example: - uses: actions/checkout@3df4ab1 # v4.0.0 This practice keeps the configuration readable and allows automated dependency management tools to track and suggest updates [8][7][3]. 3. Automate Updates: Use tools like Dependabot or Renovate to automatically update pinned SHAs [2][5][3]. These tools are designed to recognize the version tag in the comment and propose pull requests when new versions are released, minimizing the manual maintenance overhead [2][11][7]. 4. Enforce via Policy: GitHub allows organizations to enable policies that mandate SHA pinning [1][9]. When enabled, any workflow using a non-pinned action will fail, ensuring company-wide compliance [1][4][2]. 5. Audit the Dependency Tree: Remember that an action itself may call other actions [4]. Ensure that your own actions or those you maintain also pin their sub-actions to SHAs, as organization-level enforcement often checks the entire dependency tree [4]. Security Context While SHA pinning is a vital defense against tag retargeting and supply chain tampering, it does not replace the need for initial code review or trust in the action's creator [11][9]. Always verify that the SHA originates from the legitimate repository and not a fork [9]. For high-security environments, consider static analysis tools like Zizmor to audit workflows for non-pinned actions [2].

Citations:

Pin actions/cache to a full 40-character commit SHA on line 72.

Using @v6 keeps the reference mutable and vulnerable to supply-chain attacks. Pin to the full commit SHA instead, optionally with a comment indicating the version tag (e.g., actions/cache@<40-char-sha> # v6).

🧰 Tools
🪛 zizmor (1.26.1)

[error] 72-72: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/cache-warm.yml at line 72, Replace the mutable version tag
reference `@v6` with the full 40-character commit SHA for the `actions/cache`
action to prevent supply-chain vulnerabilities. Determine the commit SHA
corresponding to the v6 release of the actions/cache repository and update the
uses statement to reference that SHA directly, optionally adding a comment like
`# v6` after the SHA to maintain clarity about which version is pinned.

Source: Linters/SAST tools

with:
path: ${{ github.workspace }}/.sccache
key: sccache-${{ runner.os }}-perry-warm-${{ github.run_id }}
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/container-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ jobs:
uses: dtolnay/rust-toolchain@stable

- name: Cache cargo registry
uses: actions/cache@v4
uses: actions/cache@v6

@coderabbitai coderabbitai Bot Jun 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

cat -n .github/workflows/container-tests.yml | sed -n '95,105p;168,178p;209,219p;251,261p'

Repository: PerryTS/perry

Length of output: 1726

🏁 Script executed:

rg 'uses:' .github/workflows/container-tests.yml

Repository: PerryTS/perry

Length of output: 703

🌐 Web query:

GitHub Actions security best practices SHA pinning semantic version tags

💡 Result:

Pinning GitHub Actions to a full-length commit SHA is the recommended security best practice to prevent supply chain attacks, such as tag-retargeting or repository takeovers [1][2][3]. Key Security Principles: - Immutable References: Git tags are mutable and can be deleted, moved, or re-pushed by an attacker to point to malicious code [4][5]. In contrast, a full 40-character commit SHA is immutable and content-addressed, guaranteeing the exact code you expect runs in your workflow [2][6][3]. - Policy Enforcement: GitHub now supports organization-level policies that allow administrators to enforce SHA pinning across all repositories, causing any non-SHA-pinned action to fail [1][5][3]. - Risk Mitigation: While pinning does not protect against vulnerabilities present within the specific commit you have pinned, it prevents attackers from silently updating an action's behavior without your knowledge [7][8]. Best Practices for Implementation: - Pin to Full SHAs: Always use the full 40-character commit hash [9][4]. Never rely on short SHAs, branches, or tags for third-party actions [4][6]. - Maintain Readability with Comments: When pinning to a SHA, include the human-readable version tag in a trailing comment [7][4][3]. This allows automated tools to correlate the pin with semantic versions [7]. Example: uses: actions/checkout@b4ffde6 # v4.2.1 - Automate Updates: Use dependency management tools like Dependabot or Renovate to keep your pinned SHAs up to date [7][10][3]. Tools like Renovate can be configured with presets (e.g., helpers:pinGitHubActionDigests) to automatically open pull requests that bump the SHA while keeping the version tag comment updated [10][3]. - Strategic Trust: While SHA pinning is critical for third-party actions, some organizations may choose to allow tag-based references for internally developed or highly trusted first-party actions (e.g., those under the github-actions organization) to balance security with operational convenience [2][8][6]. However, mandatory organization-wide SHA pinning is considered the most secure posture [1][5][3].

Citations:

Pin all actions/cache references to immutable commit SHAs.

Lines 100, 173, 214, and 256 use @v6 (a mutable semantic version tag). Replace with full 40-character commit SHAs to prevent supply chain attacks and tag-retargeting exploits. Include the version tag as a trailing comment for readability (e.g., actions/cache@abc123def456... # v6).

🧰 Tools
🪛 zizmor (1.26.1)

[error] 100-100: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

[error] 100-100: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default

(cache-poisoning)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/container-tests.yml at line 100, The `actions/cache@v6`
references throughout the workflow file use mutable semantic version tags
instead of immutable commit SHAs, which creates security risks. Replace all
occurrences of `actions/cache@v6` on lines 100, 173, 214, and 256 with the full
40-character commit SHA for the v6 release, and append a trailing comment with
the version tag (e.g., `# v6`) for clarity and maintainability. This pins the
action to a specific immutable commit, preventing supply chain attacks and
tag-retargeting exploits.

Source: Linters/SAST tools

with:
path: |
~/.cargo/registry
Expand Down Expand Up @@ -170,7 +170,7 @@ jobs:
uses: dtolnay/rust-toolchain@stable

- name: Cache cargo registry
uses: actions/cache@v4
uses: actions/cache@v6
with:
path: |
~/.cargo/registry
Expand Down Expand Up @@ -211,7 +211,7 @@ jobs:
uses: dtolnay/rust-toolchain@stable

- name: Cache cargo registry
uses: actions/cache@v4
uses: actions/cache@v6
with:
path: |
~/.cargo/registry
Expand Down Expand Up @@ -253,7 +253,7 @@ jobs:
uses: dtolnay/rust-toolchain@stable

- name: Cache cargo registry
uses: actions/cache@v4
uses: actions/cache@v6
with:
path: |
~/.cargo/registry
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/simctl-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ jobs:
run: rustup target add aarch64-apple-ios-sim aarch64-apple-ios

- name: Cache cargo
uses: actions/cache@v5
uses: actions/cache@v6

@coderabbitai coderabbitai Bot Jun 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major

Pin actions/cache to a commit SHA instead of @v6.

Version tags like @v6 are mutable refs and can be updated to point to compromised versions. Use an immutable SHA pin for workflow integrity and security.

🧰 Tools
🪛 zizmor (1.26.1)

[error] 41-41: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

[error] 41-41: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default

(cache-poisoning)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/simctl-tests.yml at line 41, The `actions/cache@v6`
reference uses a mutable version tag which can be updated to point to
compromised code. Replace the `@v6` tag in the actions/cache action with a
specific immutable commit SHA (typically a full 40-character SHA-1 hash) to
ensure workflow integrity and prevent security vulnerabilities from potentially
compromised versions of the action.

with:
path: |
~/.cargo/registry
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,7 +150,7 @@ jobs:
# cache from ANY of them. The object cache therefore warms continuously
# and cross-pollinates instead of starting cold each run.
- name: Cache sccache objects
uses: actions/cache@v4
uses: actions/cache@v6

@coderabbitai coderabbitai Bot Jun 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

# First, check if the file exists and get its content around the specified lines
if [ -f .github/workflows/test.yml ]; then
  echo "=== File exists ==="
  # Get lines around 153
  echo "=== Around line 153 ==="
  sed -n '150,156p' .github/workflows/test.yml
  # Get lines around 264
  echo "=== Around line 264 ==="
  sed -n '261,267p' .github/workflows/test.yml
  # Get lines around 497
  echo "=== Around line 497 ==="
  sed -n '494,500p' .github/workflows/test.yml
else
  echo "File not found"
fi

Repository: PerryTS/perry

Length of output: 1314

🌐 Web query:

GitHub Actions pinning to commit SHA vs version tag security best practices

💡 Result:

Pinning GitHub Actions to a full-length commit SHA is considered the security gold standard and a critical best practice to mitigate supply chain attacks [1][2][3]. Core Security Differences * Commit SHA (Recommended): A full-length commit SHA is an immutable identifier [2][4]. When you pin to a SHA, your workflow is guaranteed to execute the exact code you have audited, preventing attackers from modifying the logic of an action even if they gain control of the upstream repository or retarget a tag [4][5][6]. * Version Tag (Risky): Tags (e.g., @v4, @v4.1.0) are mutable pointers [4][7][8]. A repository maintainer—or an attacker who gains access to that repository—can move a tag to point to a different, potentially malicious commit at any time [1][4][3]. Workflows referencing that tag will automatically execute the new, unreviewed code without warning [9][5]. Best Practices for Implementation * Always use a full-length SHA: Never use short SHAs (which are susceptible to collision risks) or tags for third-party actions [1][7][3]. * Preserve context with comments: To keep workflows readable and facilitate automated updates, always append the version tag as a comment [4][5]. Example: - uses: actions/checkout@3df4ab1 # v4.0.0 [5][3] * Automate updates: Pinning does not mean abandoning updates. Configure tools like Dependabot or Renovate to monitor the referenced repository; these tools understand the SHA-plus-comment format and will automatically open pull requests to bump the SHA to new, verified releases [2][10][3]. * Enforce via Policy: If you are an administrator, GitHub allows you to enforce full commit SHA pinning at the organization or repository level [9][2][5]. This policy causes any workflow attempting to use a mutable tag to fail, ensuring consistent security across your organization [9][2]. * Audit your dependencies: Use automated security tools such as zizmor, Scorecard, or various "pinning" utilities (e.g., pin-github-action, ratchet, frizbee) to scan for and remediate unpinned actions in your workflows [7][5][8]. While pinning protects you from "retargeting" attacks, it remains your responsibility to verify the code you pin [10][4]. Always prioritize actions from trusted sources, and review changes when merging updates proposed by Dependabot or Renovate [1][4].

Citations:

Pin actions/cache to immutable commit SHAs in all three cache steps.

Lines 153, 264, and 497 use mutable @v6 tags. Pinning to full-length commit SHAs (with version tags as comments for clarity) is required for action integrity and supply chain attack mitigation.

🧰 Tools
🪛 zizmor (1.26.1)

[error] 153-153: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

[error] 153-153: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default

(cache-poisoning)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/test.yml at line 153, Replace the mutable
`actions/cache@v6` tag with an immutable full-length commit SHA in all three
cache step usages throughout the workflow file. For each occurrence of `uses:
actions/cache@v6`, change it to `uses: actions/cache@{full-commit-sha}` where
the full commit SHA corresponds to the v6 release. You can include the version
tag as a comment after the SHA for clarity, such as `# v6`. Apply this change to
all three instances where the actions/cache action is used.

Source: Linters/SAST tools

with:
path: ${{ github.workspace }}/.sccache
key: sccache-${{ runner.os }}-perry-${{ github.job }}-${{ github.run_id }}
Expand Down Expand Up @@ -261,7 +261,7 @@ jobs:
# cache from ANY of them. The object cache therefore warms continuously
# and cross-pollinates instead of starting cold each run.
- name: Cache sccache objects
uses: actions/cache@v4
uses: actions/cache@v6
with:
path: ${{ github.workspace }}/.sccache
key: sccache-${{ runner.os }}-perry-${{ github.job }}-${{ github.run_id }}
Expand Down Expand Up @@ -494,7 +494,7 @@ jobs:
# cache from ANY of them. The object cache therefore warms continuously
# and cross-pollinates instead of starting cold each run.
- name: Cache sccache objects
uses: actions/cache@v4
uses: actions/cache@v6
with:
path: ${{ github.workspace }}/.sccache
key: sccache-${{ runner.os }}-perry-${{ github.job }}-${{ github.run_id }}
Expand Down
Loading