github-actions: pin third-party actions #17420
Conversation
v1v
added
backport-9.0
| @@ -13,15 +13,15 @@ jobs: | |||
| if: github.event.issue.pull_request | |||
| runs-on: ubuntu-latest | |||
| steps: | |||
| - uses: actions-ecosystem/action-regex-match@v2 | |||
There was a problem hiding this comment.
no longer need if you land #17347
| @@ -12,10 +12,10 @@ jobs: | |||
| runs-on: ubuntu-latest | |||
| steps: | |||
| - name: Checkout | |||
| uses: actions/checkout@v3 | |||
There was a problem hiding this comment.
we need to confirm from docs-team if this will break anything.
@karenzone can you please help us here. I am even not sure if we are using this after docs migration.
There was a problem hiding this comment.
checkout@v3 vs checkout@v4 should work, see https://github.com/actions/checkout/blob/main/CHANGELOG.md#v400
As far as i see it was a major change as they moved to node:20
| with: | ||
| fetch-depth: 0 | ||
| - name: Set up Ruby | ||
| uses: ruby/setup-ruby@v1 | ||
| uses: ruby/setup-ruby@7886c6653556e1164c58a7603d88286b5f708293 # v1.228.0 |
There was a problem hiding this comment.
any reason to ping specific minor version?
setup-ruby recommends using version and not to pin specific commit/release-version.
Can you double check if this really we need?
There was a problem hiding this comment.
For third-party GH actions we need to follow the hardening:
Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
⏫ , that's what InfoSec asked us to do.
So I took the latest v1 version at that time.
There was a problem hiding this comment.
dependabot will be the one actually bumping the version, see #17421
Release notes
[rn:skip]
What does this PR do?
Pin third-party actions as noted at https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
Bump version for checkout and github-scrtipts
Why is it important/What is the impact to the user?
Checklist
Author's Checklist
How to test this PR locally
Related issues
Use cases
Screenshots
Logs