You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Replaces mutable tag/branch references with immutable SHA hashes
to prevent supply chain attacks (ref: TeamPCP/Trivy March 2026).
Actions left as tags: 0
Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>
Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
While this PR aligns with security best practices for supply chain hardening, it currently contains critical logic errors that will break the CI/CD pipeline. All instances of actions/github-script@v2.0.0 use an invalid SHA hash that does not exist in the source repository.
Furthermore, although Codacy analysis is 'up to standards', the manual verification of acceptance criteria reveals that several Atlassian-related actions still require verification for correct pinning. These issues must be addressed before merging to prevent breaking existing workflows.
About this PR
To ensure that GitHub Actions remain pinned to SHA hashes in the future, consider adding an automated validation tool such as actionlint to the repository. Without automated enforcement, mutable tags may be reintroduced in future contributions.
Test suggestions
Verify 'actions/github-script' is pinned to a SHA in all workflows
Verify 'atlassian/gajira-login' is pinned to a SHA in all workflows
Verify 'atlassian/gajira-comment' is pinned to a SHA
Verify 'atlassian/gajira-create' is pinned to a SHA in all workflows
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify 'actions/github-script' is pinned to a SHA in all workflows
2. Verify 'atlassian/gajira-login' is pinned to a SHA in all workflows
3. Verify 'atlassian/gajira-comment' is pinned to a SHA
4. Verify 'atlassian/gajira-create' is pinned to a SHA in all workflows
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
Pins all GitHub Actions from mutable tags/branches to immutable SHA hashes.
This prevents supply chain attacks like the TeamPCP/Trivy incident (March 2026), where attackers force-pushed tags to point at malicious commits.
Auto-generated by the Codacy security audit script.