ci: pin third-party actions to commit SHAs - #2047
Open
arpitjain099 wants to merge 1 commit into
Open
arpitjain099 wants to merge 1 commit into
arpitjain099 wants to merge 1 commit into
Conversation
Every action outside the denoland org resolved from a mutable ref at run time. Four of them from branches or moving tags (cargo-binstall@main, install-action@nextest, rust-toolchain@nightly, and the actions/* major tags), which is the shape the tj-actions/changed-files compromise took: the attacker moved existing tags rather than publishing a new release, so every workflow tracking a tag picked up the payload on its next run. Pins all 37 non-denoland uses: to the commit each ref currently resolves to, with the version in a trailing comment. No version changes. denoland/setup-deno is left on v1 and main since it is first-party. taiki-e/install-action@nextest and dtolnay/rust-toolchain@nightly select their tool and toolchain through a default baked into action.yml on that ref rather than through the ref string itself, so pinning to the commit each one points at keeps the same default and needs no added with: block. Verified by reading action.yml at both refs. Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Second half of the follow-up to #1981, separate from #2046 so the noisy diff stays out of the behavioural change. Either can land without the other.
Every action outside the denoland org resolves from a mutable ref at run time. Four of them track something that moves on purpose:
The major-version tags belong in that list rather than above it. CVE-2025-30066 did not involve a malicious release: the attacker rewrote existing tags on tj-actions/changed-files so that every workflow tracking
@v45picked up the payload on its next run without anything in any repository changing. A pin to a commit is the only ref an upstream compromise cannot rewrite.This pins all 37 non-denoland
uses:entries to the commit each ref currently resolves to, with the version in a trailing comment. No versions change, so the actions that run after this are byte-identical to the ones running today.Two details worth flagging for review:
denoland/setup-denois left onv1andmain. It is yours, and pinning it would mean a bump in this repository every time you release it. Say the word if you would rather have it pinned as well.taiki-e/install-action@nextestanddtolnay/rust-toolchain@nightlylook like they encode their tool and toolchain in the ref string, which would break under a SHA pin. They do not. Each ref carries its ownaction.ymlwithtool: default: nextestandtoolchain: default: nightlyrespectively, so pinning to the commit that ref points at preserves the default and needs no addedwith:block. I read both files at those refs to confirm before pinning rather than assuming it.Keeping these current is
dependabotwithpackage-ecosystem: github-actions, which understands SHA pins and rewrites both the SHA and the comment. Happy to add that config in a third PR if you want it.