Pin third-party GitHub Actions to exact versions - #65
Open
cmillett wants to merge 1 commit into
Open
Conversation
Floating major tags and branch refs mean a build can silently change underfoot. Every third-party `uses:` reference now names an exact patch version instead of a moving target: - actions/checkout@v4 -> v4.4.0 - actions/setup-node@v4 -> v4.4.0 - actions/github-script@v6 -> v6.4.1 - docker/login-action@v3 -> v3.7.0 - slackapi/slack-github-action@v1 -> v1.27.1 - SonarSource/sonarqube-scan-action@master -> v8.2.1 The Sonar scanner is the significant one: it tracked an unreleased branch head, so builds ran whatever happened to be on master. It is now on a published release. Its `args` input is unchanged in v8.2.1. Version tags stay mutable, so this does not satisfy the Semgrep github-actions-mutable-action-tag rule (which requires a 40-char commit SHA). That is a deliberate tradeoff: exact tags stay readable and Dependabot-upgradable, and these are all well-known publishers. No `workflow_call` inputs changed, so callers are unaffected. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Every third-party
uses:reference in this repo's reusable workflows and composite actions now names an exact patch version instead of a floating major tag or a branch:actions/checkout@v4@v4.4.0actions/setup-node@v4@v4.4.0actions/github-script@v6@v6.4.1docker/login-action@v3@v3.7.0slackapi/slack-github-action@v1@v1.27.1SonarSource/sonarqube-scan-action@master@v8.2.127 lines across 9 files. Nothing but the refs changed.
Why
Raised by Bastion SAST as
yaml.github-actions.security.github-actions-mutable-action-tag(CWE-1357, CWE-353, OWASP A08 — Software and Data Integrity Failures). Because this repo is the org's shared pipeline and callers passsecrets: inherit, anything that changes underfoot here runs in every Woosmap service build.The Sonar scanner is the one that actually mattered: it tracked
@master, an unreleased branch head, so builds ran whatever SonarSource had most recently pushed. It is now on a published release.Deliberate deviation from the scanner's advice
Semgrep wants a full 40-character commit SHA, and version tags stay mutable — a publisher can force-repoint
v4.4.0itself. So this will not clear the finding, by choice: exact tags stay readable and Dependabot-upgradable, and these are all well-known publishers. Residual risk accepted.Woosmap/.github/.github/actions/checkout_build_helper@masteris intentionally left on@master. It is a self-reference within this repo, a relative./path cannot substitute (from a reusable workflow./resolves to the caller's checkout), and the shared-pipeline contract has callers deliberately track the current version.Risk and rollback
No
workflow_callinputs changed, so no caller can hit astartup_failure. All nine files were checked as parseable YAML and all six tags confirmed to resolve upstream;argsis still a valid input on sonarqube-scan-action v8.2.1.Every service repo calls these workflows at
@master, so this reaches all callers the moment it merges — the Sonar version change included. Worth watching one PR build afterwards. Rollback isgit revertof this commit on master, which restores the previous refs immediately for all callers.🤖 Generated with Claude Code