Semgrep's SHA Pinning Rollout Exposed CI Fragility
Semgrep said it turned on org-wide enforcement of full-length commit SHA pinning across about 350 GitHub repositories after the tj-actions/changed-files compromise, and the rollout took roughly 80 pull requests over a couple of days. The change forces GitHub Actions references to use an exact commit, not a tag or branch, before a workflow can run.
The reason is simple: a tag like `@v4` or a branch like `@main` is a movable label, so if it gets retargeted, the next workflow run downloads different code under the same name. A full 40-character SHA fixes the revision in place, which blocks tag-retargeting supply-chain attacks but also means nested or transitive unpinned actions can break when enforcement starts.
For platform teams running Actions across many repositories, the trust boundary is the reference itself, not just the repository name. Once org-level enforcement is on, any workflow still depending on tags, branches, or indirect unpinned actions can fail before execution, so the rollout problem becomes as much inventory and coordination as syntax.