github-featured / learningcircuit--local-deep-research

发布

0 发布 174 Git 标签

RSS 订阅源
  • v1.2.18 ee691428c5
    比较

    fix: Pin all remaining GitHub Actions to commit SHAs (comprehensive supply chain security) (#1122)

    frostbyte_neo 发布于 2025-11-24 19:44:43 +00:00

    • fix: Pin all remaining GitHub Actions to commit SHAs for supply chain security

    Comprehensive follow-up to PR #1118. Pins 163 GitHub Action references
    across 39 workflow files to immutable commit SHAs.

    Problem

    After PR #1118 addressed 14 OpenSSF Scorecard alerts by pinning actions
    in 9 critical workflow files, 32 additional workflow files remained with
    mutable version tag references, still posing supply chain security risks.

    Solution

    Pinned all remaining unpinned GitHub Actions to their commit SHAs while
    preserving version information in comments for maintainability.

    Actions Pinned (25 unique action@version combinations):

    Core Actions:

    • actions/cache@v4
    • actions/checkout@v5.0.0
    • actions/download-artifact@v6
    • actions/github-script@v8
    • actions/setup-node@v6
    • actions/setup-python@v6
    • actions/upload-artifact@v5.0.0

    Security & Quality Actions:

    • ossf/scorecard-action@v2.4.3
    • github/codeql-action/*@v4.31.2 (init, analyze, upload-sarif)
    • github/ossar-action@v1
    • aquasecurity/trivy-action@master
    • gitleaks/gitleaks-action@v2
    • hadolint/hadolint-action@v3.3.0
    • microsoft/DevSkim-Action@v1.0.16
    • codecov/codecov-action@v5
    • pre-commit/action@v3.0.1

    Docker Actions:

    • docker/build-push-action@v6
    • docker/login-action@v3
    • docker/metadata-action@v5
    • docker/setup-buildx-action@v3

    Tooling Actions:

    • pdm-project/setup-pdm@v4
    • peter-evans/create-pull-request@v7
    • pypa/gh-action-pypi-publish@release/v1

    Changes

    • 39 workflow files updated across all CI/CD pipelines
    • 163 total action references pinned to commit SHAs
    • All SHAs verified against source repositories via GitHub API
    • Version comments preserved for Dependabot compatibility

    Workflow Coverage:

    Updated workflows include:

    • Core testing: tests.yml, ui-tests.yml, api-tests.yml
    • Security scanning: ossf-scorecard.yml, codeql.yml, container-security.yml,
      security-tests.yml, gitleaks.yml, devskim.yml, ossar.yml
    • Performance & specialized tests: llm-tests.yml, performance-tests.yml,
      accessibility-compliance-tests.yml
    • Publishing: docker-publish.yml, publish.yml, release.yml
    • Automation: update-*.yml, sync-main-to-dev.yml
    • And 15 more workflow files

    Security Impact

    ✅ Eliminates supply chain attack surface from mutable action tags
    ✅ Ensures reproducible builds across all CI/CD workflows
    ✅ Prevents unauthorized modifications to action code
    ✅ Follows OpenSSF Scorecard and GitHub security best practices
    ✅ Complete coverage - all GitHub Actions now SHA-pinned

    Maintainability

    • Version comments enable Dependabot to detect and update pinned SHAs
    • Dependabot already configured in .github/dependabot.yml
    • No functional changes to any workflows
    • Format consistent with PR #1118

    Verification

    All SHAs verified correct via GitHub API:

    # Example verifications:
gh api repos/actions/checkout/git/ref/tags/v5.0.0
gh api repos/github/codeql-action/git/ref/tags/v4.31.2
gh api repos/ossf/scorecard-action/git/ref/tags/v2.4.3
    • chore: auto-bump version to 1.2.18

    Co-authored-by: GitHub Action action@github.com
    Co-authored-by: Daniel Petti djpetti@gmail.com

    下载附件