ci: pin GitHub Actions to commit SHAs (supply-chain hardening)#3231
Closed
Fabridev444 wants to merge 1 commit into
Closed
ci: pin GitHub Actions to commit SHAs (supply-chain hardening)#3231Fabridev444 wants to merge 1 commit into
Fabridev444 wants to merge 1 commit into
Conversation
Pins 11 unpinned action references across autocloser.yml, codeql-analysis.yml, and releases.yml to immutable commit SHAs, keeping the original semver tag as inline comment for Dependabot compatibility. Why: tags like `@v6` or `@v4` are mutable; an attacker who compromises a maintainer account (cf. tj-actions/changed-files CVE-2025-30066) can rewrite the tag silently. Commit SHAs cannot be rewritten without rebasing your repo. Dependabot will still auto-bump these comments + SHAs on new releases when the existing dependabot.yml config picks them up — no extra config needed. Generated by https://github.com/Fabridev444/gha-shield v1.0.6 via: npx Fabridev444/gha-shield .github/workflows --fix
Member
|
We'll add zizmor. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Pins all 11 unpinned GitHub Actions references across
autocloser.yml,codeql-analysis.yml, andreleases.ymlto immutable commit SHAs, keeping the original semver tag as an inline# v6comment for Dependabot compatibility.Example diff:
Why
Tags like
@v4or@v6are mutable — anyone with push access to the action's repo can rewrite them. The tj-actions/changed-files CVE-2025-30066 was a maintainer-token compromise that quietly modified existing tags to exfiltrate secrets from thousands of consumers. Commit SHAs cannot be rewritten without a force-push that breaks every downstream — so they're audit-traceable and reproducible.Recommended by:
Pinned-DependenciescheckHow
Generated mechanically with gha-shield v1.0.6:
It resolves each
<owner>/<repo>@<tag>via the GitHub commits API and rewrites the file. Original tags are preserved in# v6trailing comments — Dependabot'scommit-messagehandler reads those and bumps SHAs on every new release. No extra config needed; your existing.github/dependabot.ymlalready coversgithub-actionsecosystem.Compatibility
actions/setup-go@v6andactions/checkout@v6look unusual (latest released v5/v4 at scan time); this PR pins whatever commit the existing@v6tag currently resolves to, no version change.Verify
gha-shieldis MIT-licensed and self-hosted (npx Fabridev444/gha-shieldresolves directly from this GitHub repo, no npm publish needed). Happy to drop a Solana tip in the FUNDING.yml if useful:634UtV9dWq8G7ciosqx1pcKkBK4kNkNod9yvoM8ujSdM