gha-hazmat/.github/workflows/unpinned-images.yml at main · woodruffw/gha-hazmat · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
# unpinned-images.yml
#
# what: unpinned Docker image usage.
#
# how: GitHub Actions allows "bare" Docker image usage, e.g. `image: ubuntu` or
# `image: fake.example.com/example` without a tag or digest pin.
# like with unpinned actions, this is non-ideal and a potential security issue,
# since leaving images unpinned means that the latest image changes are always
# used.

on:
  push:
    branches:
      - master
  workflow_dispatch:

permissions: {}

jobs:
  unpinned-container-image:
    runs-on: ubuntu-latest
    container:
      image: fake.example.com/example
    steps:
      - run: echo 'vulnerable!'

  unpinned-service-container-image:
    runs-on: ubuntu-latest
    services:
      redis:
        image: fake.example.com/redis
    steps:
      - run: echo 'vulnerable!'

  unpinned-container-image-latest:
    runs-on: ubuntu-latest
    container:
      image: fake.example.com/example:latest
    steps:
      - run: echo 'vulnerable!'

  unpinned-service-container-image-latest:
    runs-on: ubuntu-latest
    services:
      redis:
        image: fake.example.com/redis:latest
    steps:
      - run: echo 'vulnerable!'

  tag-pinned-container-image:
    runs-on: ubuntu-latest
    container:
      image: fake.example.com/example:0.0.348
    steps:
      - run: echo 'not vulnerable!'

  tag-pinned-service-container-image:
    runs-on: ubuntu-latest
    services:
      redis:
        image: fake.example.com/redis:7.4.3
    steps:
      - run: echo 'not vulnerable!'

  hash-pinned-container-image:
    runs-on: ubuntu-latest
    container:
      image: fake.example.com/example@sha256:bfadbbcb25fd75c30c295843f1a861414f46c080f0f1d0c5cd93843c88edabcf
    steps:
      - run: echo 'not vulnerable!'

  hash-pinned-service-container-image:
    runs-on: ubuntu-latest
    services:
      redis:
        image: fake.example.com/redis@sha256:7df1eeff67eb0ba84f6b9d2940765a6bb1158081426745c185a03b1507de6a09
    steps:
      - run: echo 'not vulnerable!'