Add GitHub Actions security policy requiring SHA pinning

[Priyankasaggu11929]

PR adds a a new policy to establish mandatory requirement for all GitHub Actions to use commit SHA hashes instead of mutable references (tags/branches) to prevent supply chain attacks.

ref: kubernetes/org#6235

[Priyankasaggu11929]

cc: @dims

/hold
for review

[Priyankasaggu11929]

cc: @kubernetes/owners, @PushkarJ

[Priyankasaggu11929]

cc: @kubernetes/sig-security for review as well.

[PushkarJ]

@Priyankasaggu11929 Left two comments to provide more clarity. Is there a plan from GitHub Admins to create a prow job that runs on PR or on schedule that checks for these policy violations? If yes, I am happy to co-maintain (or co-create) it with you all if you think it's worth doing.

[PushkarJ]

Will dependabot PR automatically know the right SHA to upgrade to or will default to version tags that are mutable? Although there is benefit in auto-upgrades if dependabot behavior is not going to be consistent to our policy, then it might be best to remove this point from the list.

[BenTheElder]

Dependabot works with this particular style:
https://github.com/kubernetes-sigs/kind/blob/446e36866289a5b727f854011afe8e54c57da66d/.github/workflows/nerdctl.yaml#L33

[adrianmoisey]

Would it be possible to provide an example (or point at one) for dependabot?
https://github.com/kubernetes-sigs/kind/blob/main/.github/dependabot.yml is super helpful to me and I'll likely copy-pasta it into my project

[BenTheElder]

I'm not sure if we should have been including ok-to-test

[Priyankasaggu11929]

I'm not sure if we should have been including ok-to-test

Ah, just re-read it.

You meant this dependabot yaml adding ok-to-test - https://github.com/kubernetes-sigs/kind/blob/main/.github/dependabot.yml

I think, we should not and let some project maintainer do it going forward?

(that would need a further cleanup but I also think it is worth it?)

---

@PushkarJ, @adrianmoisey - I kept the dependabot pointers, because even after enforcing the policy at enterprise level, we will still need to continue maintaining them and that's where dependabot will help.

Added example reference from the github docs on how to setup.

[BenTheElder]

Yeah. Actions being able to forcibly apply labels is a big problem for our label based workflows, there are probably repos adding lgtm and approved as well ...

[upodroid]

Hey, GitHub has setting to enforce this and activating it should be sufficient.

[Priyankasaggu11929]

Thanks for the review folks.

@PushkarJ - addressing the above comments here.

Yes, the plan was to add a periodic job that scans and flags for the unintended gh actions usage across our gh orgs. But I think with the suggestion from @upodroid, we will covered.

Will also remove the dependabot reference.

And add the common branches (master, main) for clarity.

---

@upodroid - could you provide a pointer on the setting (in a DM or a docs link here - either would work), i will toggle it tomorrow and we can announce it on dev@... mailing list.

---

For this week, I am trying to focus on all immediate things we need either fixing or enforcing to address the impact.

but yes, over the next month, i can try to add more periodic jobs if we would still need some.

[upodroid]

https://docs.github.com/en/enterprise-cloud@latest/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#policies

I would probably activate it on the enterprise directly.

[PushkarJ]

Sounds good @Priyankasaggu11929, I can LGTM once the PR is updated and yes, good call on taking care of preventive and detective steps after we finish the immediate task at hand.

@upodroid thanks for the pointer. Good to know about this feature!

[BenTheElder]

Apparently we can enforce this via org policy (via @upodroid ), I think we should pursue that route.
It's hard to get people to read more 😅

[PushkarJ]

Maybe both? This documents the rationale behind the org level policy and then once enforced we add a link to actual org level setting in this sharing that it's in effect.

[cblecker]

Yes, it can be. (ref for GH admins: https://github.com/enterprises/kubernetes/settings/actions)

[Priyankasaggu11929]

@kubernetes/owners - should we enforce the policy Require actions to be pinned to a full-length commit SHA at enterprise level immediately? or inform with a deadline and then enforce?

We have about ~200 repos using GH Actions and roughly ~144 of them are using non-sha references. So, I'm assuming all of these will immediately break.

[cblecker]

My opinion: I think we should give a notice period of maybe 2 weeks for repos to update this?

[Priyankasaggu11929]

My opinion: I think we should give a notice period of maybe 2 weeks for repos to update this?

+1. If others don't have objection, then I'll send an email in the evening (Amsterdam time) on the dev@... mailing list, sharing this policy as a PSA and asking folks to update their github actions accordingly to adhere the policy. Will put a deadline of April 15 - that will give folks enough time to act on it.

@cblecker, @PushkarJ - could you help merging this PR by then, that would be helpful then to link the merged policy. I have addressed all comments so far.

[dims]

If others don't have objection, then I'll send an email in the evening (Amsterdam time) on the dev@... mailing list

yes please

[PushkarJ]

/lgtm

(Lets announce a date and then enforce)

[PushkarJ]

/assign cblecker

(For approval)

[cblecker]

/lgtm
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cblecker, Priyankasaggu11929

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• github-management/OWNERS [Priyankasaggu11929,cblecker]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Priyankasaggu11929]

/unhold

[Priyankasaggu11929]

The PSA was shared with the dev@kubernetes.io mailing list on March 27 - https://groups.google.com/a/kubernetes.io/g/dev/c/gvwLzCBx-hA/m/phP47p52AgAJ, with the following "Immediate Action Required"

Project maintainers are requested to update their GitHub Actions workflows to comply with this policy by April 15, 2026.
After this date, the Kubernetes project will enforce the "Require actions to be pinned to a full-length commit SHA" policy at the enterprise level, and any github action workflows using mutable references will fail to run.

We have reached the timeline (April 15) we put for enforcing the policy.

I'm going to turn on the "Require actions to be pinned to a full-length commit SHA" policy at the Kubernetes enterprise level today.

Before I do so, pinging once again (@kubernetes/owners, @PushkarJ, @dims) for a +1.

[jasonbraganza]

+1

Better safe, than sorry.

[dims]

+1

Would we need comms? (will actions stop running until they are compliant?)

[Priyankasaggu11929]

Would we need comms?

I plan to send an update on the earlier PSA email to inform folks, after I flip the setting.

(will actions stop running until they are compliant?)

The GH policy Docs doesn't confirm if its a preventive or retroactive policy.

So, I'm going with assumption that all GH Action workflows with mutable references will start failing until fixed.

I added a note about it in the PSA:

After this date, the Kubernetes project will enforce the "Require actions to be pinned to a full-length commit SHA" policy at the enterprise level, and any github action workflows using mutable references will fail to run.

[PushkarJ]

Seems like it is retroactive for new runs as per this: kubernetes/test-infra#36726 (comment)

Good call to add it in PSA. +1 from me

[Priyankasaggu11929]

Thanks folks. I will go ahead and toggle the "Require actions to be pinned to a full-length commit SHA" button now.

---

Update - The policy is enforced now at the Kubernetes Enterprise level.

Sent update on dev@kubernetes.io mailing list - https://groups.google.com/a/kubernetes.io/g/dev/c/gvwLzCBx-hA/m/u2Tt-5U8CAAJ