Add PR check to enforce SHA-pinned GitHub Actions

[P0NDER0SA]

Description

Follow-up to the GH Actions SHA-pinning remediation: adds a mandatory PR check that automatically fails if a workflow or composite action references a third-party action by a mutable tag/branch instead of a full 40-character commit SHA. Same implementation as cds-snc/notification-manifests#5133.

Why not Renovate or the existing OSSF Scorecard job?

• Renovate already auto-proposes PRs to keep pins updated, but it's a remediation bot — it can't block a human PR that introduces a new unpinned action.
• Scorecard's Pinned-Dependencies check only runs weekly/on push to main as a scoring job — it never runs on pull_request and doesn't fail the build.

Neither currently blocks a PR, which is the actual gap this closes.

What this does

• New workflow: .github/workflows/check_pinned_actions.yaml, triggered on pull_request/push:main when .github/workflows/** or .github/actions/** change.
• Runs zizmor and filters its results down to just the unpinned-uses finding, so it stays scoped to SHA-pinning only (zizmor's other audits, e.g. template-injection, are a separate concern, out of scope here).
• Fails the check with actionable output (file + finding) and remediation guidance in the logs if any unpinned action is found.
• Exception mechanism: an inline # zizmor: ignore[unpinned-uses] <reason> comment skips the check for that line. Demonstrated on cds-snc/notification-pr-bot@main in docker.yaml, which intentionally tracks main (already excluded from Renovate via this repo's renovate.json ignoreDeps) and can't be hash-pinned without losing that behavior.

To make this a real merge gate

Branch protection on main needs "Scan for unpinned actions" added as a required status check (not done in this PR — repo settings, not code).

Testing

Ran zizmor locally against this repo's .github/workflows: found and fixed the one pre-existing unpinned-uses finding, confirmed 0 findings remain, and confirmed the CI script correctly fails against a deliberately unpinned test workflow.

[Copilot]

Pull request overview

Adds a GitHub Actions workflow that enforces SHA-pinning for uses: references in workflows and composite actions, closing the gap where new unpinned actions could be introduced via pull requests.

Changes:

• Adds .github/workflows/check_pinned_actions.yaml to run zizmor and fail PRs/pushes when unpinned-uses findings exist in .github/workflows/** or .github/actions/**.
• Adds an inline zizmor ignore annotation for the intentionally unpinned cds-snc/notification-pr-bot@main reference in the Docker workflow.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/docker.yaml	Adds a zizmor ignore annotation for an intentionally unpinned first-party action ref.
.github/workflows/check_pinned_actions.yaml	Introduces a CI workflow that scans for unpinned uses: references and fails with actionable output.

Suppressed comments (1)

.github/workflows/check_pinned_actions.yaml:27

• If switching to pull_request_target, actions/checkout will otherwise default to checking out the base branch. Add an explicit ref so the scan analyzes the PR's head commit for pull_request_target events while still working on push events.

      - name: "Checkout code"
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.