Security: pin GitHub Actions to SHA hashes#2620
Conversation
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
While this PR successfully pins most GitHub Actions to SHA hashes, there are inconsistencies and omissions that undermine the security goals. Specifically, the actions/checkout action in mkdocs.yml uses an incorrect major version and a SHA hash inconsistent with other files in this PR. Furthermore, the Rebilly/lexi action remains pinned to a mutable tag, which contradicts the stated acceptance criteria and leaves the workflow vulnerable to supply chain attacks. Although Codacy analysis indicates the PR is 'up to standards', these functional alignment issues should be resolved to ensure the security policy is applied uniformly.
About this PR
- The security hardening is incomplete; while most actions were updated, at least one third-party action was overlooked. To meet the security objectives, every action reference must be pinned to an immutable SHA hash to prevent tag-shifting attacks.
Test suggestions
- Verify that 'actions/checkout' is pinned to a SHA hash in all workflow files
- Verify that third-party actions like 'tj-actions/changed-files' and 'atlassian/gajira' are pinned to SHA hashes
- Verify that the 'Rebilly/lexi' action in 'readability.yml' is pinned to a SHA hash
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify that the 'Rebilly/lexi' action in 'readability.yml' is pinned to a SHA hash
🗒️ Improve review quality by adding custom instructions
Replaces mutable tag/branch references with immutable SHA hashes to prevent supply chain attacks (ref: TeamPCP/Trivy March 2026). Actions left as tags: 0
jorgebraz
force-pushed
the
security/pin-actions-to-sha
branch
from
99233f5 to
3473b3f
Compare
2 participants
Pins all GitHub Actions from mutable tags/branches to immutable SHA hashes.
This prevents supply chain attacks like the TeamPCP/Trivy incident (March 2026), where attackers force-pushed tags to point at malicious commits.
Auto-generated by the Codacy security audit script.