Skip to content

fix: pin GitHub Actions to commit SHAs for security #651

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Jun 15, 2025
+167 −167
Merged

fix: pin GitHub Actions to commit SHAs for security #651

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
e299b54
Chore: add ratchet config and CI enforcement
LordMelkor Jun 13, 2025
9df336b
Fix: pin all GitHub Actions to immutable SHAs via ratchet
LordMelkor Jun 13, 2025
abcc144
Add security audit evidence of unpinned GitHub Actions
LordMelkor Jun 13, 2025
6f73a8b
remove enforcement files from fix branch
LordMelkor Jun 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
248 changes: 124 additions & 124 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,9 @@ name: CI

on:
push:
branches: [ main ]
branches: [main]
pull_request:
branches: [ main ]
branches: [main]
workflow_dispatch:

jobs:
Expand All @@ -13,112 +13,112 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version-file: .tool-versions
cache: npm
- run: npm ci
- run: npm run lint-biome && git diff --exit-code
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
with:
node-version-file: .tool-versions
cache: npm
- run: npm ci
- run: npm run lint-biome && git diff --exit-code

lint-ts:
name: Lint TypeScript
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version-file: .tool-versions
cache: npm
- run: npm ci
- run: npm run lint-ts
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
with:
node-version-file: .tool-versions
cache: npm
- run: npm ci
- run: npm run lint-ts

lint-secretlint:
name: Lint Secretlint
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version-file: .tool-versions
cache: npm
- run: npm ci
- run: npm run lint-secretlint
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
with:
node-version-file: .tool-versions
cache: npm
- run: npm ci
- run: npm run lint-secretlint

lint-website-client:
name: Lint Website Client
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version-file: .tool-versions
cache: npm
- name: Install website client dependencies
run: |
cd website/client
npm ci
- name: Lint website client
run: |
cd website/client
npm run lint
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
with:
node-version-file: .tool-versions
cache: npm
- name: Install website client dependencies
run: |
cd website/client
npm ci
- name: Lint website client
run: |
cd website/client
npm run lint

lint-website-server:
name: Lint Website Server
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version-file: .tool-versions
cache: npm
- name: Install website server dependencies
run: |
cd website/server
npm ci
- name: Lint website server
run: |
cd website/server
npm run lint
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
with:
node-version-file: .tool-versions
cache: npm
- name: Install website server dependencies
run: |
cd website/server
npm ci
- name: Lint website server
run: |
cd website/server
npm run lint

lint-browser:
name: Lint Browser Extension
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version-file: .tool-versions
cache: npm
- name: Install browser extension dependencies
run: |
cd browser
npm ci
- name: Lint browser extension
run: |
cd browser
npm run lint
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
with:
node-version-file: .tool-versions
cache: npm
- name: Install browser extension dependencies
run: |
cd browser
npm ci
- name: Lint browser extension
run: |
cd browser
npm run lint

lint-action:
name: Lint GitHub Actions
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: docker://rhysd/actionlint:latest
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
- uses: rhysd/actionlint@4e683ab8014a63fafa117492a0c6053758e6d593 # ratchet:rhysd/actionlint@v1.7.3
with:
args: "-color"

check-typos:
name: Check typos
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: crate-ci/typos@master
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
- uses: crate-ci/typos@022bdbe8ce21237ca3a95659bd6b8aef48389b9f # ratchet:crate-ci/typos@master

test:
name: Test
Expand All @@ -128,58 +128,58 @@ jobs:
node-version: [18.0.0, 18.x, 19.x, 20.x, 21.x, 22.x, 23.x, 24.x]
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v4
- name: Use Node.js ${{ matrix.node-version }}
uses: actions/setup-node@v4
with:
node-version: ${{ matrix.node-version }}
- run: npm ci
- run: npm run test --reporter=verbose
env:
CI_OS: ${{ runner.os }}
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
- name: Use Node.js ${{ matrix.node-version }}
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
with:
node-version: ${{ matrix.node-version }}
- run: npm ci
- run: npm run test --reporter=verbose
env:
CI_OS: ${{ runner.os }}

test-coverage:
name: Test coverage
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version-file: .tool-versions
cache: npm
- run: npm ci
- run: npm run test-coverage -- --reporter=verbose
env:
CI_OS: ${{ runner.os }}
- uses: actions/upload-artifact@v4
with:
name: test-coverage
path: coverage/
- uses: codecov/codecov-action@v5
with:
fail_ci_if_error: true
directory: ./coverage
env:
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
with:
node-version-file: .tool-versions
cache: npm
- run: npm ci
- run: npm run test-coverage -- --reporter=verbose
env:
CI_OS: ${{ runner.os }}
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
with:
name: test-coverage
path: coverage/
- uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # ratchet:codecov/codecov-action@v5
with:
fail_ci_if_error: true
directory: ./coverage
env:
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

test-browser:
name: Test Browser Extension
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version-file: .tool-versions
cache: npm
- name: Install browser extension dependencies
run: |
cd browser
npm ci
- name: Test browser extension
run: |
cd browser
npm run test
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
with:
node-version-file: .tool-versions
cache: npm
- name: Install browser extension dependencies
run: |
cd browser
npm ci
- name: Test browser extension
run: |
cd browser
npm run test

build-and-run:
name: Build and run
Expand All @@ -189,20 +189,20 @@ jobs:
node-version: [18.0.0, 18.x, 19.x, 20.x, 21.x, 22.x, 23.x, 24.x]
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v4
- name: Use Node.js ${{ matrix.node-version }}
uses: actions/setup-node@v4
with:
node-version: ${{ matrix.node-version }}
- run: npm ci
- run: npm run build
- name: Install only production dependencies
run: npm ci --omit=dev
- run: node bin/repomix.cjs
- run: node bin/repomix.cjs --version
- run: node bin/repomix.cjs --help
- name: Upload build artifact
uses: actions/upload-artifact@v4
with:
name: repomix-output-${{ matrix.os }}-${{ matrix.node-version }}.txt
path: repomix-output.txt
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
- name: Use Node.js ${{ matrix.node-version }}
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
with:
node-version: ${{ matrix.node-version }}
- run: npm ci
- run: npm run build
- name: Install only production dependencies
run: npm ci --omit=dev
- run: node bin/repomix.cjs
- run: node bin/repomix.cjs --version
- run: node bin/repomix.cjs --help
- name: Upload build artifact
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
with:
name: repomix-output-${{ matrix.os }}-${{ matrix.node-version }}.txt
path: repomix-output.txt
4 changes: 2 additions & 2 deletions .github/workflows/claude.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,13 +25,13 @@ jobs:
id-token: write
steps:
- name: Checkout repository
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
with:
fetch-depth: 1

- name: Run Claude Code
id: claude
uses: anthropics/claude-code-action@beta
uses: anthropics/claude-code-action@41dd0aa695a06b94f18ce26fd851bfd6ed9d8760 # ratchet:anthropics/claude-code-action@beta
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}

Loading
Loading