ci: pin all GitHub Actions to immutable SHAs - #40
Merged
Merged
Conversation
…encies) Scorecard flagged ~45 Pinned-Dependencies alerts on workflow 'uses:' lines. Tags like @v4 are mutable — the action author can move the tag at any time to point at different code, including malicious code. Replacing the tag with a full commit SHA pins the action to bytes that cannot change without producing a new SHA, which is the supply-chain hardening Scorecard wants. Generated with mheap/pin-github-action (v3.4.0). The tool resolves each 'uses: org/repo@<ref>' to the SHA the ref currently points at, leaves a trailing '# <ref>' comment so the original semantic is preserved for human readers, and only touches lines it can fully resolve. Files updated: .github/workflows/benchmark.yaml .github/workflows/build.yaml .github/workflows/bypass.yaml .github/workflows/component-tests.yaml .github/workflows/go-basic-tests.yaml .github/workflows/incluster-comp-pr-merged.yaml .github/workflows/pr-merged.yaml .github/workflows/scorecard.yml .github/workflows/sign-object.yaml Closes ~53 of 64 Pinned-Dependencies alerts (the workflow 'uses:' subset). The remaining 11 are 'containerImage not pinned by hash' / 'goCommand not pinned by hash' alerts on Dockerfiles (build/Dockerfile, build/Dockerfile.debug, clamav/Dockerfile, cmd/sign-object/Dockerfile, tests/images/malicious-app/Dockerfile) and need a separate follow-up that fetches each base image's SHA digest. Maintenance: pair this with Renovate or Dependabot ('package-ecosystem: github-actions') so SHAs auto-PR upgrade — otherwise pinning trades one staleness problem for another.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (9)
📝 WalkthroughWalkthroughThe PR pins GitHub Actions across nine workflow files to specific commit SHAs instead of floating version tags (e.g., ChangesGitHub Actions Version Pinning
Estimated Code Review Effort🎯 2 (Simple) | ⏱️ ~12 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Review rate limit: 8/10 reviews remaining, refill in 9 minutes and 30 seconds. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Scorecard / GitHub code-scanning has 64 open Pinned-Dependencies alerts (security_severity: medium). The workflow
uses:references account for ~53 of them — every line likeuses: actions/checkout@v4is flagged because tags are mutable and an action author can move them to point at different code at any time.What
Replaced every
uses: org/repo@<tag>withuses: org/repo@<sha> # <tag>across all workflow files. The trailing comment preserves the original semantic for human readers; the SHA pins the action to immutable bytes.Generated with
mheap/pin-github-actionv3.4.0.Files updated (9):
benchmark.yamlbuild.yamlbypass.yamlcomponent-tests.yamlgo-basic-tests.yamlincluster-comp-pr-merged.yamlpr-merged.yamlscorecard.ymlsign-object.yamlThe other workflow files (
incluster-comp-pr-created.yaml,pr-created.yaml) had no unpinned references to update.Coverage
Closes ~53 of 64 Pinned-Dependencies alerts (the workflow
uses:subset).The remaining 11 are Dockerfile alerts:
build/Dockerfile(lines 1, 17)build/Dockerfile.debug(lines 1, 7, 13)clamav/Dockerfile(lines 3, 10)cmd/sign-object/Dockerfile(lines 1, 17)tests/images/malicious-app/Dockerfile(lines 1, 6)Those need
FROM image:tag@sha256:<digest>style pinning, which requires fetching each base image's current digest. Out of scope for this PR — will follow up.Maintenance — IMPORTANT
Pinning to SHAs trades one staleness problem (mutable tags) for another (no auto-updates). Pair this PR with Renovate or Dependabot:
Without that, every action is frozen until someone hand-updates a SHA.
Risk
Low. SHA-pinning is a no-op for workflow behavior — every action runs at the same code it ran at before this PR (the SHAs the tags pointed at when this commit was created). The only change is the alert noise dropping.
YAML validated: all 11 workflow files parse cleanly with
yaml.safe_load.Test plan
gh api repos/k8sstormcenter/node-agent/code-scanning/alerts?state=open --jq 'map(select(.rule.name == "Pinned-Dependencies")) | length'drops by ~53 after merge