Skip to content

ci: pin actions and adjust cerbos#2065

Open
franzramadhan wants to merge 2 commits into
mainfrom
fix-cerbos-policy/1
Open

ci: pin actions and adjust cerbos#2065
franzramadhan wants to merge 2 commits into
mainfrom
fix-cerbos-policy/1

Conversation

@franzramadhan
Copy link
Copy Markdown
Contributor

Overview

What I've done

  • Pinned all GitHub Actions to specific commit SHAs across 17 workflow files to prevent supply chain attacks via mutable version tags (e.g. actions/checkout@v4actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1)
  • Added a GitHub App token step to the Cerbos policies CI workflow (ci_policies.yml) and passed it to cerbos/cerbos-setup-action via github_token to fix authentication issues when downloading Cerbos

What I haven't done

  • Did not update the pinned Cerbos version itself (still 0.40.0)
  • Did not change any workflow logic or trigger conditions — purely infra/security hardening

How I tested

  • Verified the SHA hashes correspond to the correct tagged versions by reviewing the action comments
  • Relies on CI passing after merge

Screenshot

N/A — CI workflow changes only

Which point I want you to review particularly

  • The GitHub App token setup in ci_policies.yml — confirm GH_APP_ID (var) and GH_APP_PRIVATE_KEY (secret) are correctly provisioned in the repo/org settings
  • Whether all pinned SHAs are accurate for their respective version tags (spot-check a few)

Memo

This is a security hardening change. Pinning to commit SHAs ensures workflows use an immutable snapshot of each action, protecting against tag mutation or takeover. The Cerbos token change was needed because cerbos-setup-action rate-limits unauthenticated GitHub API requests during its setup step.

Copilot AI review requested due to automatic review settings April 22, 2026 04:20
@franzramadhan franzramadhan requested a review from a team as a code owner April 22, 2026 04:20
@github-actions github-actions Bot added the cicd label Apr 22, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 22, 2026

🚀 Cloud Run Preview Deployed

🔗 Click here to open the preview in a new tab

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens the repository’s CI/CD workflows by pinning GitHub Actions to immutable commit SHAs (reducing supply-chain risk from mutable tags) and adjusts the Cerbos policies CI workflow to authenticate Cerbos setup downloads via an App token.

Changes:

  • Pinned third-party and official GitHub Actions to specific commit SHAs across the workflow suite.
  • Updated ci_policies.yml to mint a GitHub App token and pass it into cerbos/cerbos-setup-action for authenticated Cerbos setup.

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
.github/workflows/release_quality_checker.yaml Pins checkout/setup-node/github-script/tauri/rust-cache/rust-toolchain to SHAs.
.github/workflows/release.yml Pins reearth/changelog-action invocation to a commit SHA.
.github/workflows/pr.yml Pins labeler/semantic-PR/auto-author-assign actions to SHAs.
.github/workflows/license_check.yml Pins checkout/setup-node/cache to SHAs in license-check jobs.
.github/workflows/ci_websocket.yml Pins checkout/rust-toolchain/rust-cache/install-action to SHAs.
.github/workflows/ci_ui.yml Pins checkout/setup-node/cache to SHAs.
.github/workflows/ci_subscriber.yml Pins checkout/setup-go/golangci-lint/codecov to SHAs.
.github/workflows/ci_policies.yml Adds GitHub App token creation and passes token to Cerbos setup; pins related actions.
.github/workflows/ci_engine.yml Pins checkout/remove-unwanted-software/rust-cache/install-action/setup-node to SHAs.
.github/workflows/ci_api.yml Pins checkout/setup-go/golangci-lint/codecov to SHAs.
.github/workflows/ci.yml Pins checkout to SHAs in the main CI dispatcher workflow.
.github/workflows/build_docker_push_worker.yml Pins build/push workflow actions (checkout/toolchain/artifacts/docker/google auth) to SHAs.
.github/workflows/build_deploy_websocket.yml Pins build/deploy workflow actions (checkout/toolchain/artifacts/docker/google auth/gcloud) to SHAs.
.github/workflows/build_deploy_ui.yml Pins build/deploy workflow actions (checkout/setup-node/artifacts/docker/google auth/gcloud) to SHAs.
.github/workflows/build_deploy_subscriber.yml Pins build/deploy workflow actions (checkout/setup-go/artifacts/docker/google auth/gcloud) to SHAs.
.github/workflows/build_deploy_policies_cerbos.yml Pins checkout/setup-go/google auth/gcloud actions to SHAs.
.github/workflows/build_deploy_api.yml Pins checkout/setup-go/artifacts/docker/google auth/gcloud actions to SHAs.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread .github/workflows/ci_policies.yml Outdated
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants