fix(go-security): pin external actions and add github-actions label#287
fix(go-security): pin external actions and add github-actions label#287
Conversation
Resolves Pinned Actions lint failures by replacing version-tag and floating refs with full commit SHAs (with version comments) for: actions/checkout, actions/setup-go, actions/dependency-review-action, github/codeql-action/upload-sarif, securego/gosec.
Dependabot fails to apply the github-actions label referenced in .github/dependabot.yml because it does not exist in the repo. Defining it here lets labels-sync.yml create it on next run.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughAdds a new Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
lerian-studio
added
size/XS
🛡️ CodeQL Analysis ResultsLanguages analyzed: ✅ No security issues found. 🔍 View full scan logs | 🛡️ Security tab |
🔍 Lint Analysis
|
Pins the remaining external actions flagged by the Pinned Actions lint check: actions/upload-artifact, anchore/sbom-action, trufflesecurity/trufflehog, aquasecurity/trivy-action, and sonatype-nexus-community/nancy-github-action. Also moves trivy-action off the floating 0.35.0 tag to v0.36.0.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Warning
CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.
Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (3)
.github/workflows/go-security.yml (3)
153-153:⚠️ Potential issue | 🟠 MajorPin
nancy-github-actionto commit SHA with version tag.Line 153:
sonatype-nexus-community/nancy-github-action@mainmust use a pinned commit SHA instead of the floating@mainref to satisfy the documented "Pinned Actions" requirement. Update to:uses: sonatype-nexus-community/nancy-github-action@395e2fb168f674f96502e5652103d112899ea369 # v1.0.2🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/go-security.yml at line 153, Replace the floating GH Action ref used in the workflow step that currently reads "uses: sonatype-nexus-community/nancy-github-action@main" with the pinned commit SHA to satisfy the pinned-actions requirement; update that "uses" entry to "sonatype-nexus-community/nancy-github-action@395e2fb168f674f96502e5652103d112899ea369" (optionally annotating the comment "# v1.0.2") so the action is no longer on the floating main ref.
195-195:⚠️ Potential issue | 🟠 MajorPin
trufflesecurity/trufflehogto commit SHA.Line 195 uses
trufflesecurity/trufflehog@mainwith a floating branch reference. This must be pinned to a commit SHA with a version comment to match the pattern established by other actions in the workflow (e.g.,actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6).Use:
trufflesecurity/trufflehog@3fc0c2aa6648d54242e4af6fbfde0701796e4fb0 # mainNote: This workflow also contains other unpinned actions (
actions/upload-artifact@v7,anchore/sbom-action@v0,aquasecurity/trivy-action@0.35.0,sonatype-nexus-community/nancy-github-action@main) that require the same treatment for consistency with the pinning requirements.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/go-security.yml at line 195, Replace the floating reference trufflesecurity/trufflehog@main with the specific commit SHA provided (trufflesecurity/trufflehog@3fc0c2aa6648d54242e4af6fbfde0701796e4fb0) and add a trailing comment indicating the original branch/tag (e.g., "# main"); update the workflow line that currently contains uses: trufflesecurity/trufflehog@main accordingly. Also audit other action usages named actions/upload-artifact@v7, anchore/sbom-action@v0, aquasecurity/trivy-action@0.35.0, and sonatype-nexus-community/nancy-github-action@main and pin each to a fixed commit SHA with a matching version comment to match the repository's pinning pattern.
230-230:⚠️ Potential issue | 🟠 MajorPin all external actions to commit SHAs to satisfy pinning requirements.
Six action references still use version tags instead of commit SHAs:
actions/upload-artifact@v7(lines 230, 258) → pin to043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7anchore/sbom-action@v0(line 252) → pin toe22c389904149dbc22b58101806040fa8d37a610 # v0sonatype-nexus-community/nancy-github-action@main(line 153) → pin to395e2fb168f674f96502e5652103d112899ea369 # maintrufflesecurity/trufflehog@main(line 195) → pin to3fc0c2aa6648d54242e4af6fbfde0701796e4fb0 # mainaquasecurity/trivy-action@0.35.0(line 168) → obtain SHA and pin (GitHub API access restricted; retrieve manually)Per coding guidelines: "This reusable workflow pins every external action used by the job steps to a full commit SHA (with a matching
# vX.Y.Zcomment) instead of floating tags/branches."🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/go-security.yml at line 230, Replace floating action refs with pinned commit SHAs: change actions/upload-artifact@v7 to actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0 (add comment "# v7") in both occurrences, change anchore/sbom-action@v0 to anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 ("# v0"), change sonatype-nexus-community/nancy-github-action@main to sonatype-nexus-community/nancy-github-action@395e2fb168f674f96502e5652103d112899ea369 ("# main"), change trufflesecurity/trufflehog@main to trufflesecurity/trufflehog@3fc0c2aa6648d54242e4af6fbfde0701796e4fb0 ("# main"), and for aquasecurity/trivy-action@0.35.0 look up the corresponding commit SHA from the repository (or GitHub API) and replace the tag with that full SHA and a matching "# 0.35.0" comment; ensure every changed step uses the full commit SHA instead of a tag/branch.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/go-security.yml:
- Line 168: Replace the floating action reference "uses:
aquasecurity/trivy-action@0.35.0" with a pinned commit SHA for that release and
add the version comment; specifically, look for the line containing
aquasecurity/trivy-action@0.35.0 and update it to use the full commit SHA for
v0.35.0 (e.g., aquasecurity/trivy-action@<commit-sha> # v0.35.0) so the workflow
is pinned like the other actions.
---
Outside diff comments:
In @.github/workflows/go-security.yml:
- Line 153: Replace the floating GH Action ref used in the workflow step that
currently reads "uses: sonatype-nexus-community/nancy-github-action@main" with
the pinned commit SHA to satisfy the pinned-actions requirement; update that
"uses" entry to
"sonatype-nexus-community/nancy-github-action@395e2fb168f674f96502e5652103d112899ea369"
(optionally annotating the comment "# v1.0.2") so the action is no longer on the
floating main ref.
- Line 195: Replace the floating reference trufflesecurity/trufflehog@main with
the specific commit SHA provided
(trufflesecurity/trufflehog@3fc0c2aa6648d54242e4af6fbfde0701796e4fb0) and add a
trailing comment indicating the original branch/tag (e.g., "# main"); update the
workflow line that currently contains uses: trufflesecurity/trufflehog@main
accordingly. Also audit other action usages named actions/upload-artifact@v7,
anchore/sbom-action@v0, aquasecurity/trivy-action@0.35.0, and
sonatype-nexus-community/nancy-github-action@main and pin each to a fixed commit
SHA with a matching version comment to match the repository's pinning pattern.
- Line 230: Replace floating action refs with pinned commit SHAs: change
actions/upload-artifact@v7 to
actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0 (add comment "#
v7") in both occurrences, change anchore/sbom-action@v0 to
anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 ("# v0"), change
sonatype-nexus-community/nancy-github-action@main to
sonatype-nexus-community/nancy-github-action@395e2fb168f674f96502e5652103d112899ea369
("# main"), change trufflesecurity/trufflehog@main to
trufflesecurity/trufflehog@3fc0c2aa6648d54242e4af6fbfde0701796e4fb0 ("# main"),
and for aquasecurity/trivy-action@0.35.0 look up the corresponding commit SHA
from the repository (or GitHub API) and replace the tag with that full SHA and a
matching "# 0.35.0" comment; ensure every changed step uses the full commit SHA
instead of a tag/branch.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 2ab25e35-2154-4313-8686-49b83ed96c31
📒 Files selected for processing (2)
.github/labels.yml.github/workflows/go-security.yml
lerian-studio
added
size/S
There was a problem hiding this comment.
Warning
CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.
Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/go-security.yml:
- Around line 79-82: The pinned SHA for actions/upload-artifact (commented as
v7) is incorrect — replace the current SHA
(bbbca2ddaa5d8feaa63e36b76fdaad77386f024f) with the commit matching v7
(043fb46d1a93c77aae656e7c1c64a875d1fc6a0a) or change the version comment to
match the pinned SHA; locate the reference to actions/upload-artifact in the
workflow and update the SHA/comment accordingly. For aquasecurity/trivy-action
(pinned as ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0), note that
automated verification failed due to IP restrictions and perform a manual
verification of that pin (or update to a verified SHA/tag) in the workflow.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: ad3c314e-2546-4872-ae1c-7995917021d4
📒 Files selected for processing (1)
.github/workflows/go-security.yml
The SHA bbbca2dd... did not correspond to the v7 tag; replaces with 043fb46d... which matches v7.0.1 (verified via the actions/upload-artifact git ref API).
2 participants
GitHub Actions Shared Workflows
Description
Resolves the Pinned Actions lint failures reported on PR #284 by replacing version-tag and floating refs with full commit SHAs (with
# vX.Y.Zcomments) in.github/workflows/go-security.yml. Also adds the missinggithub-actionslabel to.github/labels.ymlso Dependabot can apply it as configured independabot.yml(label sync runs via.github/workflows/labels-sync.yml).Affected files:
.github/workflows/go-security.yml— pinned 10 external action references flagged by the lint check (actions/checkout,actions/setup-go,actions/dependency-review-action,github/codeql-action/upload-sarif,securego/gosec)..github/labels.yml— declared thegithub-actionslabel (color#2088FF).Type of Change
fix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)feat: New workflow or new input/output/step in an existing workflowperf: Performance improvement (e.g. caching, parallelism, reduced steps)refactor: Internal restructuring with no behavior changedocs: Documentation only (README, docs/, inline comments)ci: Changes to self-CI (workflows under.github/workflows/that run on this repo)chore: Dependency bumps, config updates, maintenancetest: Adding or updating testsBREAKING CHANGE: Callers must update their configuration after this PRBreaking Changes
None.
Testing
@developor the beta tagCaller repo / workflow run: will be validated by the self-PR validation run on this PR
Related Issues
Refs #284
Summary by CodeRabbit