Dear Tractus-X Community, dear Committer,
GitHub Actions referenced by a version tag (@v4) or a branch (@main) can change underneath us at any time. A tag can be moved or
deleted, and a branch can get new commits. A recent example is the aquasecurity/trivy-action tag hijack (GHSA-69fq-xp46-6x23): existing tags were overwritten with malicious code. Pinning every action to a full commit SHA protects us against this.
I’ve opened a PR in
every active Tractus-X repository: 42 PRs. You can find all of them in this issue:
👉
https://github.com/orgs/eclipse-tractusx/projects/61/views/1?pane=issue&itemId=297864746
What the PRs change
-
Only files under
.github/ (workflows and composite actions). README and docs examples are left as they are. -
Every PR has one commit:
chore(actions): migrate from dedicated version to sha, on branch chore/action-version-to-sha. -
No functional changes. In most cases the PR just replaces each version with the commit SHA it currently points to, and the version stays as a comment:
- uses: actions/checkout@v4
+ uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-
Dependabot understands this format and will keep raising update PRs as before.
Where a plain mapping wasn’t possible
In some repos the referenced version could not be mapped to a SHA, so I had to choose a replacement version. Each case is explained in that repo’s PR description.
Please check these PRs in particular:
-
Deleted
trivy-action tags (0.18, 0.20, 0.32, …; removed after the incident) → pinned to the safe
v0.35.0.
sd-factory, edc-kafka-extension, sldt-semantic-hub, sldt-discovery-finder, sldt-bpn-discovery, traceability-foss -
kics @master, v1.5 or v1.6 → latest release
v2.1.20.
managed-service-orchestrator, data-exchange-test-service, sd-factory, edc-kafka-extension, sldt-*, traceability-foss -
Retired versions that no longer run:
upload-artifact v3 → v4.6.2,
upload-sarif v2 → v3.
sig-infra, sldt-*, traceability-foss -
Archived or non-existent actions → successor or valid release.
google-github-actions/release-please-action → googleapis/release-please-action v4.4.1 (portal-iam, ssi-credential-issuer);
chart-releaser v1.4.6 → v1.7.0 (managed-simple-data-exchanger-backend);
sonarcloud-github-action → sonarqube-scan-action (traceability-foss) -
trufflehog@main → release v3.99.8.
knowledge-agents-*, tutorial-resources -
Our own
eclipse-tractusx/sig-infra@main → pinned to the current
main HEAD, with a # main comment.
puris, identityhub, tractusx-edc, app-dashboard, and others
What I’d ask of you as maintainers
-
Review and merge the PR for your repository. A quick look at the workflow runs is enough.
-
If an open Dependabot PR touches the same lines, merge one and rebase the other. I’ve noted these conflicts in the affected PRs.
-
From now on, please pin new actions by SHA as well (
owner/action@<sha> # vX.Y.Z). -> Will also create an TRAG for that
If something breaks (related actions) or doesn’t fit your setup, comment on the PR or reply here, and I’ll take care of it.
Thanks for your support!
Best regards,
Stephan
Stephan Bauer
Platform Domain Manager
Catena-X Automotive Network e.V.
📍 New
business address as of November 1, 2025:
Catena-X Automotive Network e.V.
c/o beyond Quartier Heidestrasse
Heidestraße 34
10557 Berlin
Registered with the Local Court of Charlottenburg (Berlin)
Registration number: VR 38942 B
Chairman of the Board: Oliver Ganser
Eclipse Tractus-X Project Lead
