Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: renovate bot setting to pin actions to a full length commit SHA

Merged

Conversation

naveensrinivasan
Copy link
Contributor

@naveensrinivasan naveensrinivasan commented May 20, 2022

Pin actions to a full length commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release.
Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository,
as they would need to generate a SHA-1 collision for a valid Git object payload.

@naveensrinivasan naveensrinivasan requested review from a team as code owners May 20, 2022
- https://docs.renovatebot.com/modules/manager/github-actions/#additional-information

- Pinned actions by SHA https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies

>Pin actions to a full length commit SHA

>Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release.
> Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository,
> as they would need to generate a SHA-1 collision for a valid Git object payload.

- https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
- https://github.com/renovatebot/.github/blob/b0c3aa85ef2bb242580f20b02b380ca532b4ce17/default.json#L13
@naveensrinivasan naveensrinivasan force-pushed the naveensrinivasan/renovate-bot branch from 53cb118 to 1e7a525 Compare May 20, 2022
@joschi joschi added security github_actions labels Jun 18, 2022
@joschi joschi added this to the 4.2.10 milestone Jun 18, 2022
joschi
joschi approved these changes Jun 18, 2022
Copy link
Member

@joschi joschi left a comment

@naveensrinivasan LGTM, thanks for your contribution!

@joschi joschi merged commit d785a56 into dropwizard:release/4.2.x Jun 18, 2022
3 checks passed
joschi pushed a commit that referenced this issue Jun 18, 2022
#2613)

- https://docs.renovatebot.com/modules/manager/github-actions/#additional-information
- Pinned actions by SHA https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies

>Pin actions to a full length commit SHA

>Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release.
> Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository,
> as they would need to generate a SHA-1 collision for a valid Git object payload.

- https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
- https://github.com/renovatebot/.github/blob/b0c3aa85ef2bb242580f20b02b380ca532b4ce17/default.json#L13

(cherry picked from commit d785a56)
joschi pushed a commit that referenced this issue Jun 18, 2022
#2613)

- https://docs.renovatebot.com/modules/manager/github-actions/#additional-information
- Pinned actions by SHA https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies

>Pin actions to a full length commit SHA

>Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release.
> Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository,
> as they would need to generate a SHA-1 collision for a valid Git object payload.

- https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
- https://github.com/renovatebot/.github/blob/b0c3aa85ef2bb242580f20b02b380ca532b4ce17/default.json#L13

(cherry picked from commit d785a56)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
github_actions security
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants