[plan] Pin unpinned-uses actions to SHAs in daily-cli-performance and issue-monster workflows #22250

Objective

Pin unpinned GitHub Actions to specific commit SHAs in daily-cli-performance.md and issue-monster.md to prevent supply chain attacks via tag mutation.

Context

Source: Static Analysis Report - 2026-03-22

Vulnerability: unpinned-uses — GitHub Actions used without pinning to a specific SHA, allowing supply chain attacks via tag mutation.

Affected files:

• .github/workflows/daily-cli-performance.md
• .github/workflows/issue-monster.md

The compiled daily-cli-performance.lock.yml contains:

uses: actions/github-script@v8

This action reference uses a mutable tag (@v8) rather than a pinned SHA.

Approach

1. Find the current SHA for actions/github-script@v8:

   gh api repos/actions/github-script/git/refs/tags/v8
   # Or: git ls-remote https://github.com/actions/github-script refs/tags/v8

2. Update the action references in the .md source files to use the full SHA:

   uses: actions/github-script@SHA_HERE  # v8

3. Check if the .md file directly specifies these actions or if they're generated by the compiler
4. If compiler-generated, update the compiler template in pkg/workflow/ to pin to SHA
5. Run make recompile to regenerate the lock files

Files to Investigate

• .github/workflows/daily-cli-performance.md
• .github/workflows/issue-monster.md
• pkg/workflow/*.go — check if actions/github-script@v8 is hardcoded in compiler templates

Acceptance Criteria

• Zizmor no longer reports unpinned-uses for daily-cli-performance and issue-monster
• All uses: references in the affected lock files point to full 40-character commit SHAs
• A comment with the original tag (e.g., # v8) is preserved for readability
• The workflows still function correctly after pinning

Generated by Plan Command for issue #discussion #22240 · ◷

• expires on Mar 24, 2026, 8:48 AM UTC