Skip to content

Commit 553567f

Browse files
bugerclaude
buger
and
claude
authored
security: harden release-5.12 — pin actions, dep guard, fix installs (#7956)
## Summary - **Pin ALL GitHub Actions to SHA-256** across all 15 workflow files — every `uses:` now references a full commit hash with original tag as comment - **Update ALL TykTechnologies/github-actions refs** to `@2b35ab5dd4cfff21ced9d12446e9e27d10bf5785` (main) - **Add dependency guard** (`dep-guard` job) to 5 workflows with `pull_request` triggers that run build/install commands: ci-tests, codeql-analysis, lint-swagger, plugin-compiler-build, release - **Fix unsafe install commands**: `pip install` → `--no-deps`, `npm install` → `--ignore-scripts` + pinned version, all `go install` in Taskfiles pinned to commit SHA - **Pin Docker images**: `tykio/ci-tools:latest` → `tykio/ci-tools@sha256:1796c0...` (3 occurrences) - **Flag curl|bash**: Added TODO comments before 2 `curl | bash` lines in release.yml Same hardening as master (PR #7943). Part of org-wide supply chain security hardening. ## Test plan - [ ] Verify CI workflows still pass (dep-guard should be transparent for non-dependency PRs) - [ ] Confirm all action SHAs resolve correctly - [ ] Verify `labeled` type addition doesn't break existing PR triggers 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent 9bcc789 commit 553567f

28 files changed

+221
-124
lines changed

‎.github/workflows/ci-tests.yml‎

Lines changed: 30 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ on:
1212
- reopened
1313
- synchronize
1414
- ready_for_review
15+
- labeled
1516
push:
1617
branches:
1718
- master
@@ -27,12 +28,19 @@ env:
2728
BRANCH_NAME: ${{ github.base_ref || github.ref_name }} # base_ref for PRs is 'master', but merges read in ref_name
2829

2930
jobs:
31+
dep-guard:
32+
if: ${{ github.event_name == 'pull_request' }}
33+
uses: TykTechnologies/github-actions/.github/workflows/dependency-guard.yml@2b35ab5dd4cfff21ced9d12446e9e27d10bf5785 # main
34+
permissions:
35+
contents: read
36+
3037
lint:
38+
needs: [dep-guard]
3139
runs-on: ubuntu-latest
3240
if: ${{ !github.event.pull_request.draft }}
3341
steps:
3442
- name: "Checkout PR"
35-
uses: TykTechnologies/github-actions/.github/actions/checkout-pr@main
43+
uses: TykTechnologies/github-actions/.github/actions/checkout-pr@2b35ab5dd4cfff21ced9d12446e9e27d10bf5785 # main
3644
with:
3745
token: ${{ secrets.ORG_GH_TOKEN }}
3846

@@ -42,15 +50,15 @@ jobs:
4250
git rev-parse origin/${{ env.BRANCH_NAME }}
4351
4452
- name: Setup Golang
45-
uses: actions/setup-go@v5
53+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
4654
with:
4755
go-version-file: go.mod
4856
cache-dependency-path: go.sum
4957

5058
- name: Setup CI Tooling
51-
uses: shrink/actions-docker-extract@v3
59+
uses: shrink/actions-docker-extract@04c17c51a5b9fd93b7aed2e05e86c8fe2d90ee52 # v3
5260
with:
53-
image: tykio/ci-tools:latest
61+
image: tykio/ci-tools@sha256:1796c0938247f42c580c501f7cd04e1144a59a62c6d8ba743572ff40371e1306 # latest
5462
path: /usr/local/bin/.
5563
destination: /usr/local/bin
5664

@@ -64,7 +72,7 @@ jobs:
6472
task --exit-code lint:check-git-state MESSAGE="task tidy made git state dirty, please run task lint locally and update PR"
6573
6674
- name: golangci-lint
67-
uses: golangci/golangci-lint-action@v8
75+
uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8
6876
timeout-minutes: 20
6977
with:
7078
version: v2.5.0
@@ -75,7 +83,7 @@ jobs:
7583
skip-cache: false
7684
skip-save-cache: false
7785

78-
- uses: actions/upload-artifact@v4
86+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
7987
if: ${{ always() }}
8088
with:
8189
name: golangcilint
@@ -102,7 +110,7 @@ jobs:
102110

103111
steps:
104112
- name: Checkout Tyk
105-
uses: actions/checkout@v4
113+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
106114
with:
107115
ref: ${{ github.ref }}
108116

@@ -114,7 +122,7 @@ jobs:
114122
# Regardless that the base image provides a python release, we need
115123
# setup-python so it properly configures the python3-venv.
116124
- name: Setup Python
117-
uses: actions/setup-python@v5
125+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
118126
with:
119127
python-version: ${{ env.PYTHON_VERSION }}
120128

@@ -125,14 +133,14 @@ jobs:
125133
run: pip -V && pip3 -V
126134

127135
- name: Setup CI Tooling
128-
uses: shrink/actions-docker-extract@v3
136+
uses: shrink/actions-docker-extract@04c17c51a5b9fd93b7aed2e05e86c8fe2d90ee52 # v3
129137
with:
130-
image: tykio/ci-tools:latest
138+
image: tykio/ci-tools@sha256:1796c0938247f42c580c501f7cd04e1144a59a62c6d8ba743572ff40371e1306 # latest
131139
path: /usr/local/bin/.
132140
destination: /usr/local/bin
133141

134142
- name: Setup Golang
135-
uses: actions/setup-go@v5
143+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
136144
with:
137145
go-version-file: go.mod
138146
cache-dependency-path: go.sum
@@ -142,10 +150,10 @@ jobs:
142150
run: |
143151
sudo apt-get install libluajit-5.1-dev
144152
145-
python -m pip install --upgrade pip
146-
pip install setuptools
147-
pip install google
148-
pip install 'protobuf==4.24.4'
153+
python -m pip install --no-deps --upgrade pip
154+
pip install --no-deps setuptools
155+
pip install --no-deps google
156+
pip install --no-deps 'protobuf==4.24.4'
149157
150158
- name: Bring up test services
151159
run: task services:up
@@ -160,14 +168,14 @@ jobs:
160168
task test:e2e-combined args="-race -timeout=15m"
161169
task test:coverage
162170
163-
- uses: actions/upload-artifact@v4
171+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
164172
if: ${{ always() }}
165173
with:
166174
name: coverage
167175
retention-days: 1
168176
path: coverage/gateway-all.cov
169177

170-
- uses: actions/upload-artifact@v4
178+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
171179
if: ${{ always() }}
172180
with:
173181
name: testjson
@@ -180,23 +188,23 @@ jobs:
180188
needs: [test, lint]
181189
steps:
182190
- name: "Checkout repository"
183-
uses: TykTechnologies/github-actions/.github/actions/checkout-pr@main
191+
uses: TykTechnologies/github-actions/.github/actions/checkout-pr@2b35ab5dd4cfff21ced9d12446e9e27d10bf5785 # main
184192
with:
185193
token: ${{ secrets.ORG_GH_TOKEN }}
186194

187195
- name: Download coverage artifacts
188-
uses: actions/download-artifact@v4
196+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
189197
with:
190198
name: coverage
191199

192200
- name: Download golangcilint artifacts
193-
uses: actions/download-artifact@v4
201+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
194202
with:
195203
name: golangcilint
196204

197205
- name: Check reports existence
198206
id: check_files
199-
uses: andstor/file-existence-action@v3
207+
uses: andstor/file-existence-action@076e0072799f4942c8bc574a82233e1e4d13e9d6 # v3
200208
with:
201209
files: 'gateway-all.cov, golangci-lint-report.json'
202210
fail: true
@@ -230,7 +238,7 @@ jobs:
230238
231239
- name: Scan
232240
if: always()
233-
uses: sonarsource/sonarqube-scan-action@master
241+
uses: sonarsource/sonarqube-scan-action@3988e54db2467c7e9583a4af619c3f5647d6b8ad # master
234242
with:
235243
args: ${{ steps.sonar_params.outputs.sonar_args }}
236244
env:

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 18 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,12 @@ name: "CodeQL"
88
on:
99
pull_request:
1010
branches: [master]
11+
types:
12+
- opened
13+
- reopened
14+
- synchronize
15+
- ready_for_review
16+
- labeled
1117
schedule:
1218
- cron: '0 18 * * 4'
1319

@@ -16,7 +22,14 @@ concurrency:
1622
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
1723

1824
jobs:
25+
dep-guard:
26+
if: ${{ github.event_name == 'pull_request' }}
27+
uses: TykTechnologies/github-actions/.github/workflows/dependency-guard.yml@2b35ab5dd4cfff21ced9d12446e9e27d10bf5785 # main
28+
permissions:
29+
contents: read
30+
1931
analyze:
32+
needs: [dep-guard]
2033
name: Analyze
2134
if: ${{ !github.event.pull_request.draft }}
2235
runs-on: ubuntu-latest
@@ -32,7 +45,7 @@ jobs:
3245

3346
steps:
3447
- name: Checkout repository
35-
uses: actions/checkout@v4
48+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
3649
with:
3750
# We must fetch at least the immediate parents so that if this is
3851
# a pull request then we can checkout the head.
@@ -44,13 +57,13 @@ jobs:
4457
if: ${{ github.event_name == 'pull_request' }}
4558

4659
- name: Install Go
47-
uses: actions/setup-go@v5
60+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
4861
with:
4962
go-version-file: go.mod
5063

5164
# Initializes the CodeQL tools for scanning.
5265
- name: Initialize CodeQL
53-
uses: github/codeql-action/init@v2
66+
uses: github/codeql-action/init@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2
5467
with:
5568
languages: ${{ matrix.language }}
5669
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -61,7 +74,7 @@ jobs:
6174
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
6275
# If this step fails, then you should remove it and run the build manually (see below)
6376
- name: Autobuild
64-
uses: github/codeql-action/autobuild@v2
77+
uses: github/codeql-action/autobuild@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2
6578

6679
# ℹ️ Command-line programs to run using the OS shell.
6780
# 📚 https://git.io/JvXDl
@@ -75,4 +88,4 @@ jobs:
7588
# make release
7689

7790
- name: Perform CodeQL Analysis
78-
uses: github/codeql-action/analyze@v2
91+
uses: github/codeql-action/analyze@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2

‎.github/workflows/force-merge.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ on:
66

77
jobs:
88
call_force_merge:
9-
uses: TykTechnologies/github-actions/.github/workflows/force-merge.yaml@main
9+
uses: TykTechnologies/github-actions/.github/workflows/force-merge.yaml@2b35ab5dd4cfff21ced9d12446e9e27d10bf5785 # main
1010
secrets:
1111
ADMIN_PAT: ${{ secrets.ORG_GH_TOKEN }}
1212
SLACK_WEBHOOK_URL: ${{ secrets.FORCE_MERGE_SLACK_WEBHOOK }}

‎.github/workflows/intelligent-branch-recomendations.yml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,14 @@ permissions:
1212
contents: read
1313

1414
jobs:
15+
dep-guard:
16+
if: ${{ github.event_name == 'pull_request' }}
17+
uses: TykTechnologies/github-actions/.github/workflows/dependency-guard.yml@2b35ab5dd4cfff21ced9d12446e9e27d10bf5785 # main
18+
permissions:
19+
contents: read
20+
1521
branch-suggestions:
16-
uses: TykTechnologies/github-actions/.github/workflows/branch-suggestion.yml@main
22+
needs: [dep-guard]
23+
uses: TykTechnologies/github-actions/.github/workflows/branch-suggestion.yml@2b35ab5dd4cfff21ced9d12446e9e27d10bf5785 # main
1724
secrets:
1825
JIRA_TOKEN: ${{ secrets.JIRA_TOKEN }}

‎.github/workflows/jira-pr-validator.yaml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,19 @@ concurrency:
99
cancel-in-progress: true
1010

1111
jobs:
12+
dep-guard:
13+
if: ${{ github.event_name == 'pull_request' }}
14+
uses: TykTechnologies/github-actions/.github/workflows/dependency-guard.yml@2b35ab5dd4cfff21ced9d12446e9e27d10bf5785 # main
15+
permissions:
16+
contents: read
17+
1218
validate:
19+
needs: [dep-guard]
1320
if: ${{ !github.event.pull_request.draft }}
1421
runs-on: ubuntu-latest
1522
steps:
1623
- name: Validate Jira ticket
17-
uses: TykTechnologies/jira-linter@main
24+
uses: TykTechnologies/jira-linter@38a9cabef56171c4e52ea698fa7be3db5fca3a49 # main
1825
with:
1926
jira-base-url: 'https://tyktech.atlassian.net'
2027
jira-api-token: ${{ secrets.JIRA_TOKEN }}

‎.github/workflows/lint-swagger.yml‎

Lines changed: 20 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,12 @@ name: "Lint swagger schema"
44

55
on:
66
pull_request:
7+
types:
8+
- opened
9+
- reopened
10+
- synchronize
11+
- ready_for_review
12+
- labeled
713
paths:
814
- 'swagger.yml'
915

@@ -12,21 +18,28 @@ concurrency:
1218
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
1319

1420
jobs:
21+
dep-guard:
22+
uses: TykTechnologies/github-actions/.github/workflows/dependency-guard.yml@2b35ab5dd4cfff21ced9d12446e9e27d10bf5785 # main
23+
permissions:
24+
contents: read
25+
1526
redocly_validator:
27+
needs: [dep-guard]
1628
runs-on: ubuntu-latest
1729
name: Validate the swagger with redocly cli
1830

1931
steps:
20-
- uses: actions/checkout@v4
21-
- uses: actions/setup-node@v4
32+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
33+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
2234
with:
2335
node-version: 20
2436
- name: Validate OpenAPI definition with redocly
2537
run: |
26-
npm install @redocly/cli -g
38+
npm install --ignore-scripts @redocly/cli@1.34.3 -g
2739
redocly lint swagger.yml --config=redocly.yml
2840
2941
diff_swagger:
42+
needs: [dep-guard]
3043
name: Diff swagger yaml for comment
3144
runs-on: ubuntu-latest
3245

@@ -38,12 +51,12 @@ jobs:
3851
git config --global url."https://${TOKEN}@github.com".insteadOf "https://github.com"
3952
4053
- name: Checkout repo
41-
uses: TykTechnologies/github-actions/.github/actions/checkout-pr@main
54+
uses: TykTechnologies/github-actions/.github/actions/checkout-pr@2b35ab5dd4cfff21ced9d12446e9e27d10bf5785 # main
4255
with:
4356
token: ${{ secrets.ORG_GH_TOKEN }}
4457

4558
- name: Setup Golang
46-
uses: actions/setup-go@v5
59+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
4760
with:
4861
go-version: stable
4962

@@ -87,15 +100,15 @@ jobs:
87100
echo "EOF" >> $GITHUB_OUTPUT
88101
89102
- name: Find Comment
90-
uses: peter-evans/find-comment@v2
103+
uses: peter-evans/find-comment@a54c31d7fa095754bfef525c0c8e5e5674c4b4b1 # v2
91104
id: fc
92105
with:
93106
issue-number: ${{ github.event.pull_request.number }}
94107
comment-author: 'github-actions[bot]'
95108
body-includes: Swagger Changes
96109

97110
- name: Create or update comment
98-
uses: peter-evans/create-or-update-comment@v3
111+
uses: peter-evans/create-or-update-comment@23ff15729ef2fc348714a3bb66d2f655ca9066f2 # v3
99112
with:
100113
comment-id: ${{ steps.fc.outputs.comment-id }}
101114
issue-number: ${{ github.event.pull_request.number }}

‎.github/workflows/lint.yml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,16 @@ concurrency:
1313
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
1414

1515
jobs:
16+
dep-guard:
17+
if: ${{ github.event_name == 'pull_request' }}
18+
uses: TykTechnologies/github-actions/.github/workflows/dependency-guard.yml@2b35ab5dd4cfff21ced9d12446e9e27d10bf5785 # main
19+
permissions:
20+
contents: read
21+
1622
godoc:
23+
needs: [dep-guard]
1724
if: ${{ !github.event.pull_request.draft }}
18-
uses: TykTechnologies/github-actions/.github/workflows/godoc.yml@main
25+
uses: TykTechnologies/github-actions/.github/workflows/godoc.yml@2b35ab5dd4cfff21ced9d12446e9e27d10bf5785 # main
1926
secrets:
2027
ORG_GH_TOKEN: ${{ secrets.ORG_GH_TOKEN }}
2128
with:

0 commit comments

Comments
 (0)