fix: pin 19 actions to commit SHA, extract 7 expressions to env vars - #92016
Conversation
|
Allow CI Workflow Run
Note: this should only be enabled once the PR is ready to go and can only be enabled by a maintainer |
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
7edb970 to
afc9ff9
Compare
|
Pushed an update. Fixed the missing trailing newline on graphite_ci_optimizer.yml and found some additional hardening opportunities:
All changes are mechanical and preserve existing workflow behavior. I also posted on Twitter about a lot of these hardening techniques if you want to read through the research, and if you like it wouldn't mind a repost. - Chris (dagecko) |
| run: echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN_ELEVATED}" > ~/.npmrc | ||
| env: | ||
| NPM_TOKEN_ELEVATED: ${{ secrets.NPM_TOKEN_ELEVATED }} |
There was a problem hiding this comment.
There's little risk of escaping issues here because the stuff in secrets.* is not user-supplied.
| CODE_FREEZE_TOKEN: ${{ secrets.CODE_FREEZE_TOKEN }} | ||
| INPUT_TYPE: ${{ github.event.inputs.type }} |
There was a problem hiding this comment.
Also, not really user-controllable, this would have to be done by somebody with workflow_dispatch permissions, but it doesn't hurt
| reproduction-comment: '.github/comments/invalid-link.md' | ||
| reproduction-hosts: 'github.com,bitbucket.org,gitlab.com,codesandbox.io,stackblitz.com' | ||
| reproduction-blocklist: 'github.com/vercel/next.js.*,github.com/\\w*/?$,github.com$' | ||
| reproduction-blocklist: 'github.com/vercel/next.js.*,github.com/\w*/?$,github.com$' |
There was a problem hiding this comment.
Ah, yep, does look like a typo, thanks
Co-authored-by: Benjamin Woodruff <github@benjam.info>
Tests Passed |
|
Thanks @dagecko. This had always bothered me a little, but I didn't prioritize it how I probably should've. |
3 participants
Re-submission of #91933. Had a problem with my fork and had to delete it, which closed the original PR. Apologies for the noise.
Summary
This PR pins all GitHub Actions to immutable commit SHAs instead of mutable version tags and extracts expressions from
run:blocks intoenv:mappings.@abc123 # v1.0.9)Changes by file
Actions Pinned
A note on internal action pinning
This PR pins all actions including org-owned ones. Best practice is to pin everything \u2014 the tj-actions/changed-files attack was an internally maintained action that was compromised, and every repo referencing it by tag silently executed attacker code. That said, it's your codebase. If you'd prefer to leave org-owned actions unpinned, let us know and we'll adjust the PR.
How to verify
Review the diff \u2014 each change is mechanical and preserves workflow behavior:
action@v3becomesaction@abc123 # v3\u2014 original version preserved as comment${{ expr }}inrun:moves toenv:block, referenced as$ENV_VARin the scriptI put up some research on this on Twitter and a research site if you want more context. I wrote a scanner called Runner Guard and open sourced it here.
If you have any questions, reach out. I'll be monitoring comms.
\- Chris Nyhuis (dagecko)