Skip to content

chore migrate gihub actions to Action Manager#177

Merged
afourneau merged 1 commit intomasterfrom
turbolift-fork-and-tag-cs-gha
Apr 15, 2026
Merged

chore migrate gihub actions to Action Manager#177
afourneau merged 1 commit intomasterfrom
turbolift-fork-and-tag-cs-gha

Conversation

@jd-hatzenbuhler
Copy link
Copy Markdown
Contributor

Description

Migrate all GitHub Actions workflow files across ContentSquare repositories to use the Actions Manager Fork-and-Approved-Tag security model.

All direct upstream action references (e.g. actions/checkout@v4) have been replaced with their ContentSquare-managed fork equivalents (e.g. ContentSquare/actions-checkout@approved-v4) using platform_github/allowed-actions.yaml as the source of truth.

Motivation and Context

The Actions Manager implements a Fork-and-Approved-Tag security model to prevent supply chain attacks. Using direct upstream action references bypasses this model and will be blocked by security controls in the future.

This change ensures all workflows use only ContentSquare-controlled forks with security-reviewed approved tags, providing:

  • Supply chain protection: only ContentSquare-controlled forks are used
  • Approved tags only: no raw upstream tags
  • Audit trail: complete approval and usage history

Breaking Changes

No breaking changes. The ContentSquare fork actions are functionally identical to their upstream counterparts — only the reference syntax changes.

Actions not present in allowed-actions.yaml (no approved fork available yet) were left unchanged.

How Has This Been Tested?

See the following CI runs in this PR

@afourneau afourneau merged commit d67372a into master Apr 15, 2026
7 checks passed
@afourneau
Copy link
Copy Markdown
Contributor

Security PR merge bypass exception

@afourneau afourneau deleted the turbolift-fork-and-tag-cs-gha branch April 15, 2026 07:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants