Pin action versions and add Dependabot cooldown - #134
Open
cmillett wants to merge 1 commit into
Open
Conversation
Addresses 16 Bastion SAST findings in this repo's CI config. Mutable action tags (15 findings, CWE-1357/353, OWASP A08). All 16 third-party `uses:` refs now name an exact patch version instead of a floating major, each resolved from what that major points at today so behaviour is unchanged: actions/checkout@v4 -> v4.4.0 actions/cache@v3 -> v3.5.0 actions/setup-node@v4 -> v4.4.0 actions/upload-artifact@v4 -> v4.6.2 aws-actions/configure-aws-credentials@v4 -> v4.3.1 peter-evans/repository-dispatch@v2 -> v2.1.2 cycjimmy/semantic-release-action@v6 -> v6.0.0 `cycjimmy/semantic-release-action@v6` was the notable one: there is no v6 tag on that repo, so the ref resolved to a *branch* named v6 — a moving head, not a version. Tag v6.0.0 points at the same commit. Missing Dependabot cooldown (1 finding, CWE-829). Adds `cooldown: default-days: 7` to hold back freshly published releases, plus a github-actions ecosystem entry so the pins above get bumped rather than silently going stale. Version tags stay mutable, so the tag findings do not satisfy the Semgrep github-actions-mutable-action-tag rule, which wants a 40-char SHA. That is a deliberate tradeoff; the cooldown covers the same threat. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses all 16 high-severity Bastion SAST findings on this repo.
Mutable action tags — 15 findings
CWE-1357 / CWE-353, OWASP A08. All 16 third-party
uses:refs now name an exact patch version instead of a floating major:actions/checkout@v4@v4.4.0actions/cache@v3@v3.5.0actions/setup-node@v4@v4.4.0actions/upload-artifact@v4@v4.6.2aws-actions/configure-aws-credentials@v4@v4.3.1peter-evans/repository-dispatch@v2@v2.1.2cycjimmy/semantic-release-action@v6@v6.0.0Each version was resolved from what its floating major points at right now, so every job runs the same code as before — the refs just say so explicitly.
The one that was genuinely bad
cycjimmy/semantic-release-action@v6— that repository has nov6tag. The ref was resolving to a branch namedv6, i.e. a moving head equivalent to@master, on the action that cuts releases. Tagv6.0.0points at the same commit (b12c8f60) and is the latest release, so this is behaviour-identical while no longer tracking a branch.Also worth flagging:
aws-actions/configure-aws-credentialsis the action that configures the credentials used to publish to S3, making it the highest-consequence pin in the repo.Why this doesn't clear the rule
Semgrep wants a 40-character commit SHA. Woosmap policy is exact version tags, not SHAs, so these are recorded as accepted risk in Bastion rather than fixed. The cooldown below covers the same threat from the other direction.
Missing Dependabot cooldown — 1 finding
CWE-829. Added
cooldown: default-days: 7to the npm entry, so freshly published releases wait a week before Dependabot proposes them — that publication window is when a compromised version is most likely to still be live.Also added a
github-actionsecosystem entry (weekly, same cooldown). Without it the exact pins above would never move; with it they get bumped on a reviewed PR. This part is additive — happy to drop it if you'd rather not have action-bump PRs.Risk and rollback
Only
uses:refs anddependabot.ymlchanged; no workflow inputs, triggers, or job logic touched. All six workflow files anddependabot.ymlverified as parseable YAML, and all seven version tags confirmed to resolve upstream. CI on this PR exercises checkout, cache, setup-node and upload-artifact directly; the S3 and release paths run post-merge. Rollback isgit revertof this commit.Follow-up, not in this PR
actions/cache@v3is a superseded major and should move to v4. That's a behavioural change, so it belongs in its own PR rather than bundled with a pinning change.🤖 Generated with Claude Code