Skip to content

Pin third-party actions to commit SHAs #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ahosgood merged 8 commits into from
Apr 22, 2026
Merged

Pin third-party actions to commit SHAs #7

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
8e0ec9f
Pin third-party actions to commit SHAs
kurtismash Apr 21, 2026
ab8e31e
Bump actions/checkout from v6.0.2 from v4.3.1
kurtismash Apr 21, 2026
318da08
Pin third-party actions to commit SHAs
kurtismash Apr 21, 2026
de13b94
Apply suggestion from @ahosgood
ahosgood Apr 21, 2026
8c39913
Remove branch cleanup workflow
ahosgood Apr 21, 2026
0fb300d
Add persist-credentials option to actions/checkout in workflows
ahosgood Apr 21, 2026
a909549
Add comment to ignore unpinned uses for version tag action
ahosgood Apr 22, 2026
bff91d9
Add comment to ignore unpinned uses for build action
ahosgood Apr 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 0 additions & 28 deletions .github/workflows/branch-cleanup.yml
View file
Open in desktop

This file was deleted.

22 changes: 15 additions & 7 deletions .github/workflows/cd.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,9 @@ jobs:
permissions:
contents: read
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Run tests
uses: ./.github/actions/node-tests

Expand All @@ -25,7 +27,9 @@ jobs:
permissions:
contents: read
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Run tests
uses: ./.github/actions/python-tests

Expand All @@ -34,7 +38,9 @@ jobs:
permissions:
contents: read
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Run tests
uses: ./.github/actions/check-formatting

Expand All @@ -48,12 +54,14 @@ jobs:
packages: write
contents: write
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Generate version tag
id: version-tag
uses: nationalarchives/ds-docker-actions/.github/actions/get-version-tag@main
uses: nationalarchives/ds-docker-actions/.github/actions/get-version-tag@main # zizmor: ignore[unpinned-uses] Owned by The National Archives

@wiz-2986343e2e wiz-2986343e2e Bot Apr 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Medium IaC Finding

Workflow should not use branch-pinned third-party actions
on resource jobs.build.steps[1].uses

More Details
This rule checks that GitHub workflow does not use branch-pinned third-party actions. This rule fails when a workflow contains steps that use third-party actions referenced by branch names (like @main, @master, @develop) instead of specific commit SHAs. Using branch-pinned actions creates a significant security risk as branches are mutable references, allowing the action maintainer to modify the code that will be executed in future workflow runs without changing the referencing workflow file. This is particularly dangerous as it could lead to supply chain attacks where malicious code is introduced after your workflow is created. To prevent this risk, pin third-party actions to specific commit SHAs.

Expected

Workflow job 'build' step[1] should pin third-party action to a commit SHA or version tag rather than a branch

Found

Workflow job 'build' step[1] uses branch-pinned third-party action: 'nationalarchives/ds-docker-actions/.github/actions/get-version-tag@main'

Security Frameworks: wf-id-1, wf-id-175


Rule ID: 88c6171f-260e-4e65-929a-3dab36a97930


To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason

If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).


To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate

@ahosgood ahosgood Apr 22, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

#wiz_ignore Owned by The National Archives

@wiz-2986343e2e wiz-2986343e2e Bot Apr 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The finding has been successfully ignored for these checks.

If you'd like to ignore this finding in all future scans, you can add a matching exception in the .wiz file.
Learn more

- name: Build Docker image
uses: nationalarchives/ds-docker-actions/.github/actions/build@main
uses: nationalarchives/ds-docker-actions/.github/actions/build@main # zizmor: ignore[unpinned-uses] Owned by The National Archives
with:
version: ${{ steps.version-tag.outputs.version-tag }}
latest: ${{ github.ref == 'refs/heads/main' }}
Expand All @@ -65,7 +73,7 @@ jobs:
wiz-project-id: ${{ secrets.WIZ_PROJECT_DIGITALSERVICES }}
- name: Create tag
if: github.ref == 'refs/heads/main'
uses: actions/github-script@v5
uses: actions/github-script@211cb3fefb35a799baa5156f9321bb774fe56294 # v5.2.0
with:
script: |
github.rest.git.createRef({
Expand Down
12 changes: 7 additions & 5 deletions .github/workflows/deploy-docs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,9 +27,11 @@ jobs:
url: ${{ steps.deployment.outputs.page_url }}
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Set up Python
uses: actions/setup-python@v5
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
with:
python-version: 3.12
- name: Install dependencies
Expand All @@ -39,11 +41,11 @@ jobs:
- name: Build
run: mkdocs build
- name: Setup Pages
uses: actions/configure-pages@v4
uses: actions/configure-pages@1f0c5cde4bc74cd7e1254d0cb4de8d49e9068c7d # v4.0.0
- name: Upload artifact
uses: actions/upload-pages-artifact@v3
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
with:
path: site
- name: Deploy to GitHub Pages
id: deployment
uses: actions/deploy-pages@v4
uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
12 changes: 9 additions & 3 deletions .github/workflows/pr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,20 +13,26 @@ jobs:
test-node:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Run tests
uses: ./.github/actions/node-tests

test-python:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Run tests
uses: ./.github/actions/python-tests

check-formatting:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Run tests
uses: ./.github/actions/check-formatting