fix(security): pin actions to SHAs, add token floor, stop tag interpolation - #152
Merged
Conversation
…lation
Supply chain. 19 action refs ran from mutable tags, including
docker/login-action, cosign-installer, attest-build-provenance and
build-push-action on the release path. All now pin a commit SHA.
Token scope. ci.yml, docker.yml, release-drafter.yml and sbom.yml had no
top-level permissions block, so any job without its own block inherited
the repository default. contents: read is now the floor; the jobs that
declare packages: write or id-token: write keep them.
Shell injection. release.yml embedded github.ref_name inside two
python -c strings and a gh release upload, and release-drafter.yml put it
in gh release create. ${{ }} expands before the shell or python parses
the line, so a crafted tag name was code. All four sites read the value
from the environment instead.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XbDBXDWWvMFa7c2jGgyq9t
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of a proactive security sweep across agentrust-io.
Action pinning (19 refs)
Mutable tags on the release path, including
docker/login-action@v4(registry credentials),sigstore/cosign-installer@v3(signing) andactions/attest-build-provenance@v4(id-token: write). All now pin a commit SHA with the version in a trailing comment.Token scope
ci.yml,docker.yml,release-drafter.ymlandsbom.ymlhad no top-levelpermissions:block, so any job without its own block inherited the repository default. Addedcontents: readas the floor.docker.ymlandsbom.ymlalready declare job-levelpackages: write/id-token: write/attestations: writeand keep them, so no job loses a capability it was using.Shell injection
release.ymlembedded the tag name inside twopython -csingle-quoted strings, and ingh release upload;release-drafter.ymldid the same ingh release create. Expression substitution happens before bash or python parses the line, so a tag name containing a quote was code rather than a value. All four sites now read the value from the environment.Defence in depth rather than a live hole: creating a tag already needs write access. It removes the primitive.
Workflow-only.
ci.ymlin this repo has mixed line endings, so the edits were applied byte-precisely to keep the diff to the 11 lines that actually changed rather than reflowing the file.🤖 Generated with Claude Code
https://claude.ai/code/session_01XbDBXDWWvMFa7c2jGgyq9t