ci: bump Shadow engine to v1.7 - #759
Conversation
Re-pin the reusable Shadow workflow from 54ec94e (v1.6) to v1.7, following the dqdl canary (awslabs/dqdl#41, merged + soaking). v1.7 adds configurable allowed_labels and a bot_name-branded rate-limit label; no .shadow.yml change here, so those features stay dormant (behavior unchanged). OIDC unaffected: the bot role's trust is sub-scoped (repo:...:*), not pinned to the workflow ref, so the ref bump doesn't affect role assumption.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| (github.actor != 'github-actions[bot]' && | ||
| (github.event.issue.pull_request == null || github.event_name == 'pull_request_target')) | ||
| uses: sudsali/shadow/.github/workflows/shadow-review.yml@54ec94e0ca8c90d9b58ff95a2a06b175a115784e | ||
| uses: sudsali/shadow/.github/workflows/shadow-review.yml@v1.7 |
There was a problem hiding this comment.
DESIGN: Re-pinning from a commit SHA to a mutable v1.7 tag reintroduces supply-chain risk per GitHub's Actions hardening guidance: if the upstream tag is moved, untrusted code runs with this workflow's secret/OIDC access. Consider pinning to the full commit SHA that v1.7 currently points to (optionally with a # v1.7 comment) to retain immutability while keeping the version readable.
Diff hunk at issue-bot.yml line 43:
uses: sudsali/shadow/.github/workflows/shadow-review.yml@v1.7(was@54ec94e0ca8c90d9b58ff95a2a06b175a115784e) and line 47:shadow_ref: v1.7(was the SHA). PR body confirms OIDC role assumption and secret usage in this workflow.
Refutation trail (why this survived the Critic's disprove pass)
Hypothesis (Investigator): Switching the pinned action reference from an immutable commit SHA to a mutable tag (v1.7) weakens supply-chain security: a re-pointed tag would execute untrusted code in a workflow that has access to repository secrets and OIDC role assumption.
Disprove attempt (Critic): The evidence is entirely within the diff. The uses: clause changes from ...shadow-review.yml@54ec94e0ca8c90d9b58ff95a2a06b175a115784e to ...shadow-review.yml@v1.7, and shadow_ref likewise. GitHub's documented hardening guidance ("Security hardening for GitHub Actions") explicitly recommends pinning third-party actions to a full-length commit SHA precisely because tags are mutable. The PR body acknowledges the workflow assumes an IAM role (OIDC) and handles secrets, confirming the blast radius. The codebase navigation tools are scoped to the Scala source tree and cannot inspect the external sudsali/shadow repo or the tag's mutability, so no tool-based falsification is possible; the concern rests on the well-established immutability property of SHAs vs tags.
The Critic's default verdict is OVERTURNED. UPHELD findings are those it tried — and failed — to refute.
Address review feedback on #759: pin the reusable workflow to the full commit SHA v1.7 points to (ed31ed7) with a '# v1.7' comment, per GitHub Actions supply-chain hardening — a mutable tag could be re-pointed to run untrusted code with this workflow's OIDC/secret access. Immutable + readable.
SamPom100
left a comment
SamPom100
left a comment
There was a problem hiding this comment.
following the awslabs/dqdl#41 (merged and soaking).
this is a new one lol
2 participants
Summary
Re-pin the Shadow PR-review engine from
54ec94e(v1.6) to v1.7, following the dqdl canary (merged and soaking).v1.7 adds configurable
allowed_labelsand abot.name-branded rate-limit label. No.shadow.ymlchange here, so those features stay dormant — behavior is unchanged; this only moves the engine version.Changes
.github/workflows/issue-bot.yml— bumpuses:andshadow_reffrom the54ec94eSHA to thev1.7tag (both must move together; GitHub forbids expressions inuses:).Safety
repo:<this-repo>:*, not pinned to a workflow ref, so the engine-ref change doesn't affect role assumption.54ec94e.By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.