ci: pin third-party GitHub Actions to full-length commit SHAs - #62
Open
dmchaledev wants to merge 1 commit into
Open
ci: pin third-party GitHub Actions to full-length commit SHAs#62dmchaledev wants to merge 1 commit into
dmchaledev wants to merge 1 commit into
Conversation
Mutable version tags (@v4, @v5, etc.) can be repointed to a different commit at any time by the action maintainer or an attacker who compromises the action's publishing credentials, letting CI silently pull unreviewed code on the next run. deploy-docs.yml runs with pages: write / id-token: write, so a compromised action there could push arbitrary content to the live docs site. Pin every uses: line in both workflows to the commit SHA it currently resolves to, with the version kept as a trailing comment; Dependabot's github-actions ecosystem (already configured) natively keeps SHA-pinned actions updated. Fixes #57 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RRpaudJJXHRQu1pBS3dc3t
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Both workflow files referenced third-party GitHub Actions by mutable version tag (
@v4,@v5, etc.) rather than an immutable commit SHA. A tag can be repointed to a different commit at any time — by the maintainer or by an attacker who compromises the action's publishing credentials — and the next CI run would silently pull the new code with no diff in this repo to review.deploy-docs.ymlruns withpages: write/id-token: write, so a compromised action there could push arbitrary content to the live docs site. This mirrors the mechanism behind the March 2025tj-actions/changed-filessupply-chain compromise.uses:line in.github/workflows/validate-openapi.ymland.github/workflows/deploy-docs.ymlto the full 40-character commit SHA it currently resolves to, with the version kept as a trailing comment for readability.github-actionsecosystem (already configured in.github/dependabot.yml) natively keeps SHA-pinned actions up to date, updating both the SHA and the version comment in future PRs.Fixes #57
Test plan
python3 -c "import yaml; yaml.safe_load(open(f))"on both workflow files to confirm valid YAMLgit ls-remote --tagsfor the corresponding upstream repo to confirm it matches the intended release tagValidate OpenAPI Specs) runs on this PR and passes with the pinnedactions/checkout/actions/setup-nodeGenerated by Claude Code