feat: add commit reachability checks - #2
Merged
Conversation
nodeselector
force-pushed
the
ns/reachability-checks
branch
2 times, most recently
from
April 23, 2026 21:44
d01ae41 to
73dbd1b
Compare
nodeselector
marked this pull request as ready for review
April 23, 2026 21:49
There was a problem hiding this comment.
Pull request overview
This PR hardens gh-actions-pin against supply-chain attacks by adding commit reachability verification: ensuring the pinned SHA is actually on the lineage of the referenced tag/branch in the canonical repository (detecting fork-network injection/tag poisoning patterns).
Changes:
- Add REST-based reachability checks using GitHub’s Compare API (with caching + test override hook).
- Surface reachability results during
pin(warn-only) andcheck(validation error on unreachable; warning on unknown). - Expand unit/integration test coverage and extend the HTTP mock helper to support REST endpoints.
Show a summary per file
| File | Description |
|---|---|
root.go |
Adds reachability validation/warnings to pin and check, plus new output/skip behavior. |
internal/resolver/resolver.go |
Introduces REST client + reachability API (Compare API) with caching and batch helper. |
internal/resolver/resolver_test.go |
Adds unit tests for reachability behavior (reachable/unreachable/unknown/caching/dedup). |
internal/resolver/reachability_integration_test.go |
Adds live integration tests (tagged integration) against real GitHub fixtures. |
internal/httpmock/httpmock.go |
Adds REST request matcher and status responder to support Compare API tests. |
command_test.go |
Adapts command harness to inject reachability behavior; adds end-to-end “tampered/unreachable” style tests. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 6/6 changed files
- Comments generated: 4
|
Warning This is an internal experiment to assess Copilot's ability to auto-approve PRs. Please 👍 this comment if the assessment below is correct and 👎 if not. Feedback in #f-ccr-auto-approve is appreciated! Copilot thinks this PR is not ready to approve — see review comments for details. |
nodeselector
force-pushed
the
ns/reachability-checks
branch
from
April 23, 2026 22:50
789256a to
bad5127
Compare
Adds reachability verification using the GitHub compare API to catch supply chain attacks where a SHA exists in the shared object store but is not on the canonical repository's lineage. Detection: - check command: UNREACHABLE = validation failure (fail-closed) - pin/upgrade commands: UNREACHABLE = warning only (defense-in-depth) - API errors (rate limit, 500) = Unknown, warn but don't block Tests model 4 real-world supply chain attacks: - tj-actions/changed-files (CVE-2025-30066) - reviewdog/action-setup (CVE-2025-30154) - aquasecurity/trivy-action (CVE-2026-33634) - Checkmarx KICS (TeamPCP lateral movement) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Uses nodeselector/actions-test-fixtures with: - tag v1 on main HEAD (identical → reachable) - root commit of main (ancestor → reachable) - orphan-poison branch commit (no common ancestor → unreachable) - fabricated SHA (404 → unreachable) - cache consistency verification Guarded by //go:build integration — won't run without -tags integration. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- URL-escape ref and SHA in Compare API path to handle refs with slashes (e.g. feature/foo) that would break the URL path segments - Add DepKey field to ReachabilityResult and thread dep.Key() through CheckReachabilityAll so error messages include the full dependency key including subpath (e.g. actions/cache/save@v4 not actions/cache@v4) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
nodeselector
force-pushed
the
ns/reachability-checks
branch
from
April 23, 2026 22:54
bad5127 to
2bba3eb
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
too expensive to do during job invocation time but we could do it at pin time & at ci time. this isn't a 100% fix to the situation at all by any means but it does harden our position. for example, here's me avoiding the latest trivy compromise:
Sample workflow: