fix(ci): pin guardrail actions to SHAs and guard body-file usage#19232
Conversation
Pin actions/checkout and actions/github-script to immutable commit SHAs in scanner-merge-guardrails.yml to prevent supply-chain attacks via tag force-push. Guard --body-file usage in kb-nightly-validation.yml to handle cases where kb-gap-report.md is not generated. Fixes #18643, Fixes #19072 Signed-off-by: Andrew Anderson <andy@clubanderson.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
kubestellar-prow
Bot
added
the
dco-signoff: yes
✅ Deploy Preview for kubestellarconsole canceled.
|
|
👋 Hey @clubanderson — thanks for opening this PR!
This is an automated message. |
|
🐝 Hi @clubanderson! I'm Trusted users — org members and contributors with write access — can mention Automation may take a moment to start, and follow-up happens through workflow activity rather than chat replies. |
kubestellar-prow
Bot
added
the
size/S
There was a problem hiding this comment.
Pull request overview
This PR hardens CI workflows by pinning GitHub Actions to immutable commit SHAs (mitigating tag force-push/supply-chain risk) and by preventing the KB Nightly Validation workflow from failing when kb-gap-report.md is not present.
Changes:
- Pin
actions/checkoutandactions/github-scriptto commit SHAs inscanner-merge-guardrails.yml. - Guard
gh issue create --body-file kb-gap-report.mdbehind a file-exists check inkb-nightly-validation.ymland fall back to a plain--body.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| .github/workflows/scanner-merge-guardrails.yml | Pins previously tag-based actions to immutable SHAs for supply-chain hardening. |
| .github/workflows/kb-nightly-validation.yml | Avoids workflow crashes when kb-gap-report.md isn’t generated by conditionally using --body-file. |
| gh issue create \ | ||
| --title "$TITLE" \ | ||
| --label "kb-gap,triage/needed,help wanted" \ | ||
| --body "KB Nightly Validation failed. No gap report was generated. See workflow run for details: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" |
|
Thank you for your contribution! Your PR has been merged. Check out what's new:
Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey |
|
Post-merge build verification passed ✅ Both Go and frontend builds compiled successfully against merge commit |
Summary
actions/checkoutandactions/github-scriptto immutable commit SHAs inscanner-merge-guardrails.ymlto prevent supply-chain attacks via tag force-push--body-fileusage inkb-nightly-validation.ymlso the workflow doesn't crash whenkb-gap-report.mdisn't generatedFixes #18643, Fixes #19072