Pin GitHub Actions to commit hashes for security#537
Conversation
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
|
Build succeeded. ✔️ pre-commit SUCCESS in 2m 04s |
Why exclude Packit actions? |
because I think we trust our team/process more the external ones and I suppose the risk is therefore lower with our own actions. But if you think it is better to pin down all of them, then I will do it. |
I don't think this is about trust, do you think it's less likely for an attacker to get access to one of our repos and "retarget" a tag than to any third-party repo? |
Not less likely than for a GitHub repo, but for other third-party repos yes, I consider it less likely. However, I see your point, and I will change our actions too. |
Pin all actions to specific commit SHAs to prevent supply chain attacks and ensure reproducible builds. Assisted-By: Claude Sonnet 4.5 <noreply@anthropic.com>
majamassarini
force-pushed
the
pin-actions
branch
from
61297e7 to
918ef04
Compare
|
Build succeeded. ✔️ pre-commit SUCCESS in 2m 07s |
| check_release_notes: | ||
| name: Notes are either written, or there are none | ||
| uses: packit/.github/.github/workflows/check-release-notes.yml@main | ||
| uses: packit/.github/.github/workflows/check-release-notes.yml@2837c96caf71966609451ad0323552ef4be11a23 # main |
There was a problem hiding this comment.
This has quite a trade-off of needing to babysit the these updates based on commit bumps to main. May not be that big of an issue if everyone remembers to bump when the relevant files in packit/packit change.
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 |
There was a problem hiding this comment.
Note that a per-requisite for these is to change the tag from vX to vX.Y.Z, otherwise tools like dependabot and renovate would not work properly (yes it would just freeze to the commit you gave, but also not give you any updates either). Although, these have not been updated since v3 so far anyway 😅.
4 participants
Pin github actions to specific commit SHAs to prevent supply chain attacks and ensure reproducible builds.
Assisted-By: Claude Sonnet 4.5