fix: pin GitHub Actions to commit SHAs for security #651
Conversation
|
Note Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported. |
There was a problem hiding this comment.
Pull Request Overview
This PR pins all GitHub Actions workflow dependencies to specific commit SHAs to enhance the security and reliability of the CI/CD pipeline by preventing potential supply chain attacks.
- Pinned GitHub Actions and Docker actions in seven workflow files.
- Preserved original tag references in comments for easier future updates.
Reviewed Changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/test-action.yml | Updated actions/checkout and actions/upload-artifact |
| .github/workflows/pack-repository.yml | Updated actions/checkout, repomix action, and upload-artifact |
| .github/workflows/homebrew.yml | Updated Homebrew setup actions |
| .github/workflows/docker.yml | Pinned actions for checkout, Docker metadata, QEMU, Buildx, login, and build-push |
| .github/workflows/codeql.yml | Pinned CodeQL actions for init and analyze |
| .github/workflows/claude.yml | Updated actions/checkout and claude-code action |
| .github/workflows/ci.yml | Pinned multiple actions (checkout, setup-node, actionlint, upload-artifact, etc.) |
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the WalkthroughThis update modifies several GitHub Actions workflow files to replace version tags or branch references with specific commit SHAs for all referenced actions. Minor formatting adjustments, such as array syntax and indentation, were also made. No workflow logic, job structure, or control flow was changed. Changes
Possibly related PRs
✨ Finishing Touches🧪 Generate Unit Tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Keep this branch focused only on the SHA pinning security fix. Enforcement tooling belongs in the separate chore branch.
yamadashy
force-pushed
the
fix/pin-github-actions-shas
branch
from
ea07e32 to
6f73a8b
Compare
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #651 +/- ##
=======================================
Coverage 90.38% 90.38%
=======================================
Files 96 96
Lines 5024 5024
Branches 1052 1052
=======================================
Hits 4541 4541
Misses 483 483 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
Hi, @LordMelkor ! I've also run I'll go ahead and merge this. |
Summary
Pins all GitHub Actions workflow dependencies to specific commit SHAs to address potential security vulnerabilities where mutable tag references could be compromised. This change enhances the security and reliability of the CI/CD pipeline.
Changes
.github/workflows/directory.uses:statements for third-party GitHub Actions have been changed from tags (e.g.,@v4,@main) to specific 40-character commit SHAs.docker://rhysd/actionlint:latestreference inci.ymlwas replaced with a pinned action:rhysd/actionlint@<sha>.# ratchet:actions/checkout@v4) for maintainability and easier future updates.Files Modified
.github/workflows/ci.yml.github/workflows/claude.yml.github/workflows/codeql.yml.github/workflows/docker.yml.github/workflows/homebrew.yml.github/workflows/pack-repository.yml.github/workflows/test-action.ymlTesting & Validation
Security Impact
This change mitigates a potential supply chain attack vector. By using immutable commit SHAs, we ensure that the specific version of an action used in our workflows cannot be altered by the action maintainer after the fact (e.g., by force-pushing to a tag). This aligns with GitHub's security best practices for Actions.
See: Security hardening for GitHub Actions - Using third-party actions