From 9d512e24d35c0fed56b86c7ed70cb12735f15744 Mon Sep 17 00:00:00 2001 From: Flint <263629284+tps-flint@users.noreply.github.com> Date: Sun, 5 Jul 2026 22:15:19 -0700 Subject: [PATCH] fix(ci): pin unpinned GitHub Actions to commit SHAs (semgrep SAST gate) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Semgrep's github-actions-mutable-action-tag rule flagged 19 unpinned `uses: org/action@vN` references across docker.yml, release.yml, and test.yml (CodeQL steps) — mutable version tags can be silently repointed by the action owner, a known supply-chain attack vector (trivy-action, kics-github-action). All 19 findings were this single rule; none were application-level security bugs. Pinned each to the commit SHA the tag currently resolves to (verified via `gh api repos///commits/`), keeping the `# vN` comment for readability — matching the convention already used for actions/checkout, oven-sh/setup-bun, and socketdev/action elsewhere in these workflows. No suppressions added. Semgrep now reports 0 findings locally with the exact CI invocation. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/docker.yml | 10 +++++----- .github/workflows/release.yml | 24 ++++++++++++------------ .github/workflows/test.yml | 4 ++-- 3 files changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index c101416..37cecc9 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -20,7 +20,7 @@ jobs: runs-on: ubuntu-latest if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Determine version id: version @@ -42,20 +42,20 @@ jobs: fi - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Log in to ghcr.io - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Build and push - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 with: context: . file: docker/Dockerfile diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e121684..07bbb55 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,7 +14,7 @@ jobs: name: Release Preflight runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: fetch-depth: 0 - name: Verify tag is on main @@ -61,8 +61,8 @@ jobs: artifact: tps-linux-x64 runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: oven-sh/setup-bun@v2 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 with: bun-version: "1.3.10" - uses: socketdev/action@ba6de6cc0565af1f42295590380973573297e31f # v1.3.2 @@ -94,7 +94,7 @@ jobs: chmod +x /tmp/release/${PKG}/tps cp packages/${PKG}/README.md /tmp/release/${PKG}/README.md - name: Upload staging artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: ${{ matrix.pkg }} path: /tmp/release/${{ matrix.pkg }} @@ -105,8 +105,8 @@ jobs: needs: preflight runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: oven-sh/setup-bun@v2 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 with: bun-version: "1.3.10" - uses: socketdev/action@ba6de6cc0565af1f42295590380973573297e31f # v1.3.2 @@ -140,12 +140,12 @@ jobs: contents: read id-token: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Download all binary artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: path: /tmp/release - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: '24' registry-url: https://registry.npmjs.org/ @@ -155,7 +155,7 @@ jobs: cp -R /tmp/release/cli-darwin-x64/. packages/cli-darwin-x64/ cp -R /tmp/release/cli-linux-arm64/. packages/cli-linux-arm64/ cp -R /tmp/release/cli-linux-x64/. packages/cli-linux-x64/ - - uses: oven-sh/setup-bun@v2 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 with: bun-version: "1.3.10" - uses: socketdev/action@ba6de6cc0565af1f42295590380973573297e31f # v1.3.2 @@ -214,7 +214,7 @@ jobs: needs: [build-binaries, publish-packages] runs-on: ubuntu-latest steps: - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: path: /tmp/release - name: Create release artifacts @@ -224,7 +224,7 @@ jobs: cat /tmp/release/cli-linux-arm64/tps-linux-arm64.sha256 cat /tmp/release/cli-linux-x64/tps-linux-x64.sha256 - name: Publish checksums to GitHub release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2 with: files: | /tmp/release/cli-darwin-arm64/tps-darwin-arm64 diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 790b70b..e0bbd21 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -129,8 +129,8 @@ jobs: steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@411c4c9a36b3fca4d674f06b6396b2c6d23522c6 # v3 with: languages: javascript-typescript - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@411c4c9a36b3fca4d674f06b6396b2c6d23522c6 # v3