Skip to content

Commit 77c8cb8

Browse files
sionsmithclaude
sionsmith
and
claude
committed
fix: pin GitHub Actions to immutable commit SHAs
Mitigates supply chain attacks via tag mutation (CVE-2025-30066) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent 925c91f commit 77c8cb8

4 files changed

Lines changed: 63 additions & 54 deletions

File tree

‎.github/workflows/docker-publish.yml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: Build & Push Docker Image
22

3+
permissions:
4+
contents: read
5+
36
on:
47
push:
58
tags:
@@ -17,20 +20,20 @@ jobs:
1720

1821
steps:
1922
- name: Checkout repository
20-
uses: actions/checkout@v4
23+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
2124

2225
- name: Set up Docker Buildx
23-
uses: docker/setup-buildx-action@v3
26+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
2427

2528
- name: Log in to Docker Hub
26-
uses: docker/login-action@v3
29+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
2730
with:
2831
username: ${{ secrets.DOCKER_USERNAME }}
2932
password: ${{ secrets.DOCKER_TOKEN }}
3033

3134
- name: Extract metadata
3235
id: meta
33-
uses: docker/metadata-action@v5
36+
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
3437
with:
3538
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
3639
tags: |
@@ -39,7 +42,7 @@ jobs:
3942
type=raw,value=latest
4043
4144
- name: Build and push Docker image
42-
uses: docker/build-push-action@v5
45+
uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
4346
with:
4447
context: .
4548
file: docker/Dockerfile
@@ -51,7 +54,7 @@ jobs:
5154
platforms: linux/amd64,linux/arm64
5255

5356
- name: Update Docker Hub description
54-
uses: peter-evans/dockerhub-description@v4
57+
uses: peter-evans/dockerhub-description@432a30c9e07499fd01da9f8a49f0faf9e0ca5b77 # v4
5558
with:
5659
username: ${{ secrets.DOCKER_USERNAME }}
5760
password: ${{ secrets.DOCKER_TOKEN }}

‎.github/workflows/release.yml‎

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ jobs:
5656
env:
5757
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
5858
steps:
59-
- uses: actions/checkout@v4
59+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
6060
with:
6161
persist-credentials: false
6262
submodules: recursive
@@ -66,7 +66,7 @@ jobs:
6666
shell: bash
6767
run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.30.2/cargo-dist-installer.sh | sh"
6868
- name: Cache dist
69-
uses: actions/upload-artifact@v4
69+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
7070
with:
7171
name: cargo-dist-cache
7272
path: ~/.cargo/bin/dist
@@ -82,7 +82,7 @@ jobs:
8282
cat plan-dist-manifest.json
8383
echo "manifest=$(jq -c "." plan-dist-manifest.json)" >> "$GITHUB_OUTPUT"
8484
- name: "Upload dist-manifest.json"
85-
uses: actions/upload-artifact@v4
85+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
8686
with:
8787
name: artifacts-plan-dist-manifest
8888
path: plan-dist-manifest.json
@@ -116,7 +116,7 @@ jobs:
116116
- name: enable windows longpaths
117117
run: |
118118
git config --global core.longpaths true
119-
- uses: actions/checkout@v4
119+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
120120
with:
121121
persist-credentials: false
122122
submodules: recursive
@@ -131,7 +131,7 @@ jobs:
131131
run: ${{ matrix.install_dist.run }}
132132
# Get the dist-manifest
133133
- name: Fetch local artifacts
134-
uses: actions/download-artifact@v4
134+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
135135
with:
136136
pattern: artifacts-*
137137
path: target/distrib/
@@ -158,7 +158,7 @@ jobs:
158158
159159
cp dist-manifest.json "$BUILD_MANIFEST_NAME"
160160
- name: "Upload artifacts"
161-
uses: actions/upload-artifact@v4
161+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
162162
with:
163163
name: artifacts-build-local-${{ join(matrix.targets, '_') }}
164164
path: |
@@ -175,19 +175,19 @@ jobs:
175175
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
176176
BUILD_MANIFEST_NAME: target/distrib/global-dist-manifest.json
177177
steps:
178-
- uses: actions/checkout@v4
178+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
179179
with:
180180
persist-credentials: false
181181
submodules: recursive
182182
- name: Install cached dist
183-
uses: actions/download-artifact@v4
183+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
184184
with:
185185
name: cargo-dist-cache
186186
path: ~/.cargo/bin/
187187
- run: chmod +x ~/.cargo/bin/dist
188188
# Get all the local artifacts for the global tasks to use (for e.g. checksums)
189189
- name: Fetch local artifacts
190-
uses: actions/download-artifact@v4
190+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
191191
with:
192192
pattern: artifacts-*
193193
path: target/distrib/
@@ -205,7 +205,7 @@ jobs:
205205
206206
cp dist-manifest.json "$BUILD_MANIFEST_NAME"
207207
- name: "Upload artifacts"
208-
uses: actions/upload-artifact@v4
208+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
209209
with:
210210
name: artifacts-build-global
211211
path: |
@@ -223,12 +223,12 @@ jobs:
223223
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
224224
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
225225
steps:
226-
- uses: actions/checkout@v4
226+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
227227
with:
228228
persist-credentials: false
229229
submodules: recursive
230230
- name: Install Rust toolchain
231-
uses: dtolnay/rust-toolchain@stable
231+
uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # stable
232232
- name: Verify publishable (dry-run)
233233
run: cargo publish -p kafka-remapper-core --dry-run
234234
- name: Publish to crates.io
@@ -249,19 +249,19 @@ jobs:
249249
outputs:
250250
val: ${{ steps.host.outputs.manifest }}
251251
steps:
252-
- uses: actions/checkout@v4
252+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
253253
with:
254254
persist-credentials: false
255255
submodules: recursive
256256
- name: Install cached dist
257-
uses: actions/download-artifact@v4
257+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
258258
with:
259259
name: cargo-dist-cache
260260
path: ~/.cargo/bin/
261261
- run: chmod +x ~/.cargo/bin/dist
262262
# Fetch artifacts from scratch-storage
263263
- name: Fetch artifacts
264-
uses: actions/download-artifact@v4
264+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
265265
with:
266266
pattern: artifacts-*
267267
path: target/distrib/
@@ -274,14 +274,14 @@ jobs:
274274
cat dist-manifest.json
275275
echo "manifest=$(jq -c "." dist-manifest.json)" >> "$GITHUB_OUTPUT"
276276
- name: "Upload dist-manifest.json"
277-
uses: actions/upload-artifact@v4
277+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
278278
with:
279279
# Overwrite the previous copy
280280
name: artifacts-dist-manifest
281281
path: dist-manifest.json
282282
# Create a GitHub Release while uploading all files to it
283283
- name: "Download GitHub Artifacts"
284-
uses: actions/download-artifact@v4
284+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
285285
with:
286286
pattern: artifacts-*
287287
path: artifacts
@@ -314,14 +314,14 @@ jobs:
314314
GITHUB_EMAIL: "admin+bot@axo.dev"
315315
if: ${{ !fromJson(needs.plan.outputs.val).announcement_is_prerelease || fromJson(needs.plan.outputs.val).publish_prereleases }}
316316
steps:
317-
- uses: actions/checkout@v4
317+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
318318
with:
319319
persist-credentials: true
320320
repository: "osodevops/homebrew-tap"
321321
token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
322322
# So we have access to the formula
323323
- name: Fetch homebrew formulae
324-
uses: actions/download-artifact@v4
324+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
325325
with:
326326
pattern: artifacts-*
327327
path: Formula/
@@ -357,7 +357,7 @@ jobs:
357357
if: ${{ !fromJson(needs.plan.outputs.val).announcement_is_prerelease || fromJson(needs.plan.outputs.val).publish_prereleases }}
358358
steps:
359359
- name: Dispatch Scoop manifest update
360-
uses: actions/github-script@v7
360+
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
361361
with:
362362
github-token: ${{ secrets.SCOOP_BUCKET_TOKEN }}
363363
script: |
@@ -385,7 +385,7 @@ jobs:
385385
env:
386386
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
387387
steps:
388-
- uses: actions/checkout@v4
388+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
389389
with:
390390
persist-credentials: false
391391
submodules: recursive

‎.github/workflows/semver-check.yml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: Semver Check
22

3+
permissions:
4+
contents: read
5+
36
on:
47
pull_request:
58
paths:
@@ -11,15 +14,15 @@ jobs:
1114
name: Detect Breaking Changes
1215
runs-on: ubuntu-latest
1316
steps:
14-
- uses: actions/checkout@v4
17+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
1518
with:
1619
fetch-depth: 0 # Need full history for baseline comparison
1720

1821
- name: Install Rust toolchain
19-
uses: dtolnay/rust-toolchain@stable
22+
uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # stable
2023

2124
- name: Run cargo-semver-checks
22-
uses: obi1kenobi/cargo-semver-checks-action@v2
25+
uses: obi1kenobi/cargo-semver-checks-action@5b298c9520f7096a4683c0bd981a7ac5a7e249ae # v2
2326
with:
2427
package: kafka-remapper-core
2528
version-tag-prefix: v

0 commit comments

Comments
 (0)