security(ci): pin GHA using immutable digests instead of mutable versions#705
security(ci): pin GHA using immutable digests instead of mutable versions#705mvanhorn wants to merge 1 commit into
Conversation
Pin every third-party `uses:` reference across all workflow files and the composite action to its full 40-character commit SHA, with the human-readable version tag preserved as a trailing comment so Renovate and Dependabot can keep them current. Mutable version tags can be repointed by an upstream maintainer or a compromised account, so pinning to immutable digests closes that supply-chain vector. The first-party OWASP/cve-lite-cli@v1 self-reference in self-scan.yml is intentionally left on its major tag. Refs OWASP#597
|
Hi @mvanhorn - the PR looks good, just needs a rebase onto the current main before we can merge. Could you run |
|
Hey @mvanhorn — this branch has fallen behind main. Could you rebase against main and push? CI is green on the current commits so it should be straightforward. |
|
Hey @mvanhorn - this branch is a bit behind main. Could you rebase against main and force-push? Happy to review once it's up to date. |
|
Hey, this branch is behind main - could you rebase against the latest main and push? Happy to pick this up for review once it's up to date. |
sonukapoor
left a comment
sonukapoor
left a comment
There was a problem hiding this comment.
SHA pinning with version comments is the right pattern for preventing tag mutation attacks. One thing to confirm before merge: were these SHAs generated by a pinning tool (e.g. pin-github-action)? The v6.x version comments are higher than what I can independently verify - if those are accurate that is fine, but want to make sure the comments match the actual tags rather than being placeholder values.
2 participants
Summary
Pin every third-party GitHub Actions
uses:reference across the workflow files and the compositeaction.ymlto its full 40-character commit SHA, with the human-readable version tag preserved as a trailing comment so Renovate and Dependabot can keep them current.Why this change
Referencing actions by mutable version tags (e.g.
actions/setup-node@v6,github/codeql-action/init@v4) is a supply-chain risk: a tag can be silently repointed by an upstream maintainer or a compromised account, changing the code that runs in CI without any visible diff here. Pinning to immutable commit digests closes that vector. For a security-scanning tool this also hardens the project against the exact class of issue it helps users detect. Requested in #597 and acknowledged by the maintainer.What changed
# vX.Y.Ztag comment:actions/checkout→df4cb1c(v6.0.3),actions/setup-node→48b55a0(v6.4.0),actions/upload-pages-artifact→fc324d3(v5.0.0),actions/deploy-pages→cd2ce8f(v5.0.0),actions/attest-build-provenance→e8998f9(v2.4.0),github/codeql-action/{init,autobuild,analyze,upload-sarif}→8aad20d(v4.36.2).ci.yml,codeql.yml,docs-site.yml,release.yml,self-scan.yml, andaction.yml.OWASP/cve-lite-cli@v1self-reference inself-scan.ymlon its major tag (intentional, tracks the major release line).Validation
repos/<action>/git/ref/tags/<tag>, dereferencing annotated tags to the underlying commit) and cross-checked against the precise semver tag pointing at that commit; the trailing comment reflects that exact version.grep -rE "uses: .+@v[0-9]" .github/ action.ymlnow returns only the intentionally-unpinned first-party self-reference; no third-party mutable tags remain.User-facing impact
Does this change:
CI/build configuration only; no runtime or scanning behavior change.
Notes
Closes #597.