Security: pin GitHub Actions to SHA hashes

[jorgebraz]

Pins all GitHub Actions from mutable tags/branches to immutable SHA hashes.

This prevents supply chain attacks like the TeamPCP/Trivy incident (March 2026), where attackers force-pushed tags to point at malicious commits.

Auto-generated by the Codacy security audit script.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Alerts:

"

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes. Give us feedback}

[codacy-production]

Pull Request Overview

While this PR achieves its goal of hardening security through SHA pinning, it contains several critical flaws that should prevent merging. A high-risk script injection vulnerability was identified in the comment_issue.yml workflow due to direct interpolation of user-controlled data. Additionally, several 'if' conditions rely on environment variables that are not defined, which will cause multiple steps to be skipped. There is also a risk of workflow crashes due to unsafe regex handling. Although Codacy identifies the PR as up to standards, these logic and security bugs in the custom scripts require immediate remediation.

Test suggestions

• Verify that 'Comment issue on Jira' workflow still functions correctly using the pinned SHAs for github-script, gajira-login, and gajira-comment.
• Verify that 'Create issue on Jira' workflow still functions correctly using the pinned SHAs for gajira-login, gajira-create, and github-script.
• Verify that 'Create issue on Jira when labeled' workflow still functions correctly using the pinned SHAs for gajira-login, gajira-create, and github-script.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify that 'Comment issue on Jira' workflow still functions correctly using the pinned SHAs for github-script, gajira-login, and gajira-comment.
2. Verify that 'Create issue on Jira' workflow still functions correctly using the pinned SHAs for gajira-login, gajira-create, and github-script.
3. Verify that 'Create issue on Jira when labeled' workflow still functions correctly using the pinned SHAs for gajira-login, gajira-create, and github-script.

---

🗒️ Improve review quality by adding custom instructions

[codacy-production]

_{🔴 HIGH RISK}

The if condition for this step (and subsequent Jira-related steps) will always evaluate to false because env.GITHUB_ISSUE_TYPE and env.GITHUB_ISSUE_HAS_JIRA_ISSUE_LABEL are not defined in the job-level environment. Try running the following prompt in your coding agent: > Fix the if conditions in .github/workflows/comment_issue.yml by replacing env.GITHUB_ISSUE_TYPE with steps.github_issue_type.outputs.result and env.GITHUB_ISSUE_HAS_JIRA_ISSUE_LABEL with steps.github_issue_has_jira_issue_label.outputs.result.

[codacy-production]

_{🔴 HIGH RISK}

While pinning to a SHA is a good security practice, the script block itself is vulnerable to script injection because it uses direct GitHub Actions interpolation like ${{ toJson(...) }}. It is safer to pass all dynamic data via environment variables and access them through process.env in the script. Try running the following prompt in your coding agent: > Refactor the actions/github-script steps in the workflows to pass user-controlled values (like github.event.issue) via the env context instead of using interpolation directly inside the script string.

[codacy-production]

_{🟡 MEDIUM RISK}

The Octokit API calls in this script are asynchronous but are not awaited. This may cause the step to finish successfully before the issue is actually updated or labeled. Try running the following prompt in your coding agent: > Update the actions/github-script block in .github/workflows/create_issue.yml to use await for all github.issues.* method calls.

[codacy-production]

_{🟡 MEDIUM RISK}

The logic for extracting the Jira task number is unsafe. If the Jira project key is not found in the title, match() returns null, and the workflow will crash when accessing index [1]. Try running the following prompt in your coding agent: > In .github/workflows/comment_issue.yml, update the extraction script to safely check if the regex match result is not null before attempting to access its captures.