chore(ci): pin third-party GitHub Actions to commit SHA - #540
Conversation
Tag refs can be re-pointed by a compromised maintainer to inject malicious code into CI (e.g. the tj-actions/changed-files incident, March 2025). Pin every third-party action to its full commit SHA, with the resolved tag kept as a trailing comment for readability. First-party ./path and same-repo reusable workflow refs are left alone since branch protection already covers them. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
@jeffersongoncalves Thanks a lot for this, and for keeping the resolved tags as comments. I verified all the pinned SHAs against their tags and everything checks out. One thought: without automation these pins will go stale over time and the version comments will slowly drift from reality. Since the repo has no Dependabot config yet, what do you think about adding a Happy to merge either way. If you'd rather keep this PR focused, a follow-up works too. |
Auto-update pinned action SHAs weekly. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
@debba Added .github/dependabot.yml (github-actions ecosystem, weekly) so pinned SHAs get automatic update PRs going forward. |
2 participants
Summary
actions/checkout,pnpm/action-setup,actions/setup-node,dtolnay/rust-toolchain,swatinem/rust-cache,tauri-apps/tauri-action,KSXGitHub/github-actions-deploy-aur,vedantmgoyal9/winget-releaser,snapcore/action-build,snapcore/action-publish) to a full 40-char commit SHA, keeping the resolved tag as a trailing comment../.github/workflows/build.yml) left as-is — already covered by branch protection.Motivation: tag-pinned actions can be silently re-pointed to malicious code by a compromised maintainer, as happened with
tj-actions/changed-filesin March 2025 (secrets exfiltrated from thousands of repos mid-run). SHA pinning guarantees the code that ran yesterday runs again today.Test plan