Pin github actions with ratchet

[averevki]

Summary

• Pin all GitHub Action references to commit SHAs using ratchet
• Add a ratchet-check CI workflow that lints pull requests for unpinned action references
• Add ratchet, ratchet-pin, and verify-ratchet make targets in make/verify.mk

Part of the work on Kuadrant/kuadrant-operator#2055

Motivation

Tags are mutable — action maintainers can force-push them, silently changing the code our CI runs. Pinning to commit SHAs makes each reference immutable, mitigating supply-chain attacks.

Summary by CodeRabbit

• Security & Reliability

  • GitHub Actions are now pinned to immutable commit references, improving build and release reproducibility.
  • Added automated checks to verify that workflow actions remain securely pinned.

• Bug Fixes

  • Corrected release workflow event configuration to ensure pull-request closure events are handled properly.

• Developer Tools

  • Added commands for pinning and validating workflow action references.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9f757500-b3cd-49cd-a348-ad8315b9472c

📥 Commits

Reviewing files that changed from the base of the PR and between c06abb4 and d4816b7.

📒 Files selected for processing (2)

• .github/workflows/ratchet-check.yaml
• make/verify.mk

🚧 Files skipped from review as they are similar to previous changes (2)

• make/verify.mk
• .github/workflows/ratchet-check.yaml

---

📝 Walkthrough

Walkthrough

The pull request pins GitHub Actions to commit SHAs, adds Ratchet-based verification, and corrects the release workflow event structure.

Changes

GitHub Actions pinning

Layer / File(s)	Summary
Pin action references .github/actions/setup-rust-wasm/action.yaml, .github/workflows/*	Workflow and composite-action references now use commit SHAs. Existing version annotations and workflow configuration remain in place.
Enforce action pinning .github/workflows/ratchet-check.yaml, make/verify.mk	The repository adds Ratchet targets and a pull-request workflow to pin and verify action references in GitHub Actions YAML files.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• Kuadrant/wasm-shim#329: Pins actions in overlapping workflow and composite-action files.

Suggested labels: enhancement

Poem

A rabbit checks each action’s trace,
And pins it firmly into place.
Ratchet hops through YAML bright,
Keeping every workflow right.
SHA by SHA, the burrow’s sound.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarises the main change: pinning GitHub Actions with Ratchet.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch pin-versions-with-ratchet

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/build-image.yaml:
- Line 25: Disable credential persistence for every actions/checkout step: add
persist-credentials: false at .github/workflows/build-image.yaml:25,
.github/workflows/e2e.yaml:18 and 34, .github/workflows/license-scan.yaml:17,
.github/workflows/rust.yaml:20, 30, and 42, and .github/workflows/tests.yaml:18.

In @.github/workflows/ratchet-check.yaml:
- Around line 5-6: Extend Ratchet enforcement to composite actions: in
.github/workflows/ratchet-check.yaml lines 5-6 add .github/actions/** to the
pull-request paths, and in lines 24-26 add glob patterns for
.github/actions/**/*.yaml and .github/actions/**/*.yml; in make/verify.mk lines
14-18 include .github/actions in both find expressions.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ce83bc5b-0510-4c9f-89ed-82d5d2fc66f7

📥 Commits

Reviewing files that changed from the base of the PR and between af0f9b4 and c06abb4.

📒 Files selected for processing (12)

• .github/actions/setup-rust-wasm/action.yaml
• .github/workflows/automated-release.yaml
• .github/workflows/build-image.yaml
• .github/workflows/e2e.yaml
• .github/workflows/issues-workflow.yaml
• .github/workflows/license-scan.yaml
• .github/workflows/ratchet-check.yaml
• .github/workflows/release.yaml
• .github/workflows/rust.yaml
• .github/workflows/sector-release.yaml
• .github/workflows/tests.yaml
• make/verify.mk

[adam-cattermole]

Any reason to use checkout@v4 vs checkout@v6 used elsewhere in the project?