Skip to content

Commit 4c22d90

Browse files
nikagraCopilot
nikagra
and
Copilot
authored
Pin GitHub Actions to specific commit SHAs (#873)
Replace all third-party action version tags (e.g. @v4, @v5) with immutable commit SHAs to reduce supply chain attack surface. Version tags are mutable and can be redirected to malicious code; SHAs are permanent. The pinned versions are: actions/checkout v4.3.1 34e114876b0b11c390a56381ad16ebd13914f8d5 actions/checkout v5.0.1 93cb6efe18208431cddfb8368fd83d5badbf9bfd actions/setup-java v5.2.0 be666c2fcd27ec809703dec50e508c2fdc7f6654 actions/setup-python v5.6.0 a26af69be951a213d495a4c3e4e4022e16d87065 actions/setup-python v6.2.0 a309ff8b426b58ec0e2a45f0f869d46889d02405 actions/cache (restore/save) v4.3.0 0057852bfaa89a56745cba8c7296529d2fc39830 actions/upload-artifact v4.6.2 ea165f8d65b6e75b540449e92b4886f43607fa02 mikepenz/action-junit-report v5.6.2 3585e9575db828022551b4231f165eb59a0e74e3 dorny/test-reporter v1 3eeb9fc888e82e8be2fb356bbeec2750231672bc Also adds a section to CONTRIBUTING.md explaining how to safely update pinned actions in the future (find SHA for tag, verify no impostor commit, update workflow files and repo settings allowlist). Closes: DRIVER-583 Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
1 parent 40ef71a commit 4c22d90

7 files changed

Lines changed: 71 additions & 43 deletions

File tree

‎.github/workflows/docs-pages.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,19 +20,19 @@ jobs:
2020
runs-on: ubuntu-latest
2121
steps:
2222
- name: Checkout
23-
uses: actions/checkout@v4
23+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
2424
with:
2525
ref: ${{ github.event.repository.default_branch }}
2626
persist-credentials: false
2727
fetch-depth: 0
2828

2929
- name: Set up Python
30-
uses: actions/setup-python@v5
30+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
3131
with:
3232
python-version: '3.10'
3333

3434
- name: Set up JDK 8.0
35-
uses: actions/setup-java@v5
35+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
3636
with:
3737
java-version: 8.0
3838
distribution: 'temurin'

‎.github/workflows/docs-pr.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,18 +18,18 @@ jobs:
1818
runs-on: ubuntu-latest
1919
steps:
2020
- name: Checkout
21-
uses: actions/checkout@v4
21+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
2222
with:
2323
persist-credentials: false
2424
fetch-depth: 0
2525

2626
- name: Set up Python
27-
uses: actions/setup-python@v5
27+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
2828
with:
2929
python-version: '3.10'
3030

3131
- name: Set up JDK 8.0
32-
uses: actions/setup-java@v5
32+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
3333
with:
3434
java-version: 8.0
3535
distribution: 'temurin'

‎.github/workflows/release.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ jobs:
3131

3232
steps:
3333
- name: Checkout Repository
34-
uses: actions/checkout@v4
34+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
3535

3636
- name: Checkout Code One Commit Before ${{ inputs.version_tag }}
3737
if: inputs.target-tag != 'scylla-3.x'
@@ -40,7 +40,7 @@ jobs:
4040
run: make checkout-one-commit-before
4141

4242
- name: Set up Java
43-
uses: actions/setup-java@v5
43+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
4444
with:
4545
java-version: '11'
4646
distribution: 'temurin'
@@ -82,7 +82,7 @@ jobs:
8282

8383
- name: Upload release logs
8484
if: failure()
85-
uses: actions/upload-artifact@v4
85+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
8686
with:
8787
name: maven-stdout
8888
path: /tmp/java-driver-release-logs/*.log

‎.github/workflows/tests-reports-4x@v1.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515

1616
steps:
1717
- name: Generate test report
18-
uses: dorny/test-reporter@v1
18+
uses: dorny/test-reporter@3eeb9fc888e82e8be2fb356bbeec2750231672bc # v1
1919
with:
2020
artifact: 'test-results'
2121
name: 'Test report'

‎.github/workflows/tests-reports@v1.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515

1616
steps:
1717
- name: Generate test report
18-
uses: dorny/test-reporter@v1
18+
uses: dorny/test-reporter@3eeb9fc888e82e8be2fb356bbeec2750231672bc # v1
1919
with:
2020
artifact: 'test-results'
2121
name: 'Test report'

‎.github/workflows/tests@v1.yml‎

Lines changed: 32 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -40,10 +40,10 @@ jobs:
4040

4141
steps:
4242
- name: Checkout source
43-
uses: actions/checkout@v5
43+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
4444

4545
- name: Set up JDK ${{ matrix.java-version }}
46-
uses: actions/setup-java@v5
46+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
4747
with:
4848
java-version: ${{ matrix.java-version }}
4949
distribution: 'temurin'
@@ -53,7 +53,7 @@ jobs:
5353
run: echo "value=${{ hashFiles('**/pom.xml') }}" >> "$GITHUB_OUTPUT"
5454

5555
- name: Restore maven repository cache
56-
uses: actions/cache/restore@v4
56+
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
5757
id: java-cache
5858
with:
5959
path: ~/.m2/repository
@@ -67,7 +67,7 @@ jobs:
6767
run: make download-all-dependencies
6868

6969
- name: Save maven repository cache
70-
uses: actions/cache/save@v4
70+
uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
7171
if: steps.java-cache.outputs.cache-hit != 'true'
7272
with:
7373
path: ~/.m2/repository
@@ -85,16 +85,16 @@ jobs:
8585

8686
steps:
8787
- name: Checkout source
88-
uses: actions/checkout@v5
88+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
8989

9090
- name: Set up JDK ${{ matrix.java-version }}
91-
uses: actions/setup-java@v5
91+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
9292
with:
9393
java-version: ${{ matrix.java-version }}
9494
distribution: 'temurin'
9595

9696
- name: Restore maven repository cache
97-
uses: actions/cache/restore@v4
97+
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
9898
with:
9999
path: ~/.m2/repository
100100
key: ${{ runner.os }}-${{ matrix.java-version }}-maven-${{ hashFiles('**/pom.xml') }}
@@ -114,16 +114,16 @@ jobs:
114114

115115
steps:
116116
- name: Checkout source
117-
uses: actions/checkout@v5
117+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
118118

119119
- name: Set up JDK 8
120-
uses: actions/setup-java@v5
120+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
121121
with:
122122
java-version: ${{ matrix.java-version }}
123123
distribution: 'temurin'
124124

125125
- name: Restore maven repository cache
126-
uses: actions/cache/restore@v4
126+
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
127127
with:
128128
path: ~/.m2/repository
129129
key: ${{ runner.os }}-${{ matrix.java-version }}-maven-${{ hashFiles('**/pom.xml') }}
@@ -139,14 +139,14 @@ jobs:
139139
cp --parents ./**/target/*-reports/*.xml unit/
140140
141141
- name: Upload test results
142-
uses: actions/upload-artifact@v4
142+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
143143
if: always()
144144
with:
145145
name: test-results
146146
path: "*/**/target/*-reports/*.xml"
147147

148148
- name: Parse test results
149-
uses: mikepenz/action-junit-report@v5
149+
uses: mikepenz/action-junit-report@3585e9575db828022551b4231f165eb59a0e74e3 # v5.6.2
150150
if: always()
151151
with:
152152
check_name: Unit tests report
@@ -164,10 +164,10 @@ jobs:
164164

165165
steps:
166166
- name: Checkout source
167-
uses: actions/checkout@v5
167+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
168168

169169
- name: Setup Python 3
170-
uses: actions/setup-python@v6
170+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
171171
with:
172172
python-version: '3.13'
173173

@@ -185,22 +185,22 @@ jobs:
185185

186186
steps:
187187
- name: Checkout source
188-
uses: actions/checkout@v5
188+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
189189

190190
- name: Set up JDK ${{ matrix.java-version }}
191-
uses: actions/setup-java@v5
191+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
192192
with:
193193
java-version: ${{ matrix.java-version }}
194194
distribution: 'temurin'
195195

196196
- name: Restore maven repository cache
197-
uses: actions/cache/restore@v4
197+
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
198198
with:
199199
path: ~/.m2/repository
200200
key: ${{ runner.os }}-${{ matrix.java-version }}-maven-${{ hashFiles('**/pom.xml') }}
201201

202202
- name: Setup Python 3
203-
uses: actions/setup-python@v6
203+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
204204
with:
205205
python-version: '3.13'
206206

@@ -214,7 +214,7 @@ jobs:
214214
run: make resolve-cassandra-version
215215

216216
- name: Pull CCM image from the cache
217-
uses: actions/cache/restore@v4
217+
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
218218
id: ccm-cache
219219
with:
220220
path: ~/.ccm/repository
@@ -228,7 +228,7 @@ jobs:
228228

229229
- name: Save CCM image into the cache
230230
if: steps.ccm-cache.outputs.cache-hit != 'true'
231-
uses: actions/cache/save@v4
231+
uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
232232
with:
233233
path: ~/.ccm/repository
234234
key: ccm-cassandra-${{ runner.os }}-${{ steps.cassandra-version.outputs.value }}
@@ -248,20 +248,20 @@ jobs:
248248
249249
- name: Upload test results
250250
if: steps.run-integration-tests.outcome == 'failure'
251-
uses: actions/upload-artifact@v4
251+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
252252
with:
253253
name: test-results-${{ matrix.java-version }}-${{ matrix.cassandra-version }}
254254
path: "*/**/target/*-reports/*.xml"
255255

256256
- name: Upload CCM logs
257-
uses: actions/upload-artifact@v4
257+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
258258
if: failure()
259259
with:
260260
name: ccm-log-cassandra-${{ matrix.java-version }}-${{ matrix.cassandra-version }}
261261
path: /tmp/ccm*/ccm*/node*/logs/*
262262

263263
- name: Parse test results
264-
uses: mikepenz/action-junit-report@v5
264+
uses: mikepenz/action-junit-report@3585e9575db828022551b4231f165eb59a0e74e3 # v5.6.2
265265
if: always()
266266
with:
267267
check_name: Integration tests report for Cassandra ${{ steps.cassandra-version.outputs.value }}
@@ -286,22 +286,22 @@ jobs:
286286

287287
steps:
288288
- name: Checkout source
289-
uses: actions/checkout@v5
289+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
290290

291291
- name: Set up JDK ${{ matrix.java-version }}
292-
uses: actions/setup-java@v5
292+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
293293
with:
294294
java-version: ${{ matrix.java-version }}
295295
distribution: 'temurin'
296296

297297
- name: Restore maven repository cache
298-
uses: actions/cache/restore@v4
298+
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
299299
with:
300300
path: ~/.m2/repository
301301
key: ${{ runner.os }}-${{ matrix.java-version }}-maven-${{ hashFiles('**/pom.xml') }}
302302

303303
- name: Setup Python 3
304-
uses: actions/setup-python@v6
304+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
305305
with:
306306
python-version: '3.13'
307307

@@ -313,7 +313,7 @@ jobs:
313313
run: make resolve-scylla-version
314314

315315
- name: Pull CCM image from the cache
316-
uses: actions/cache/restore@v4
316+
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
317317
id: ccm-cache
318318
with:
319319
path: ~/.ccm/scylla-repository
@@ -326,7 +326,7 @@ jobs:
326326
run: make download-scylla
327327

328328
- name: Save CCM image into the cache
329-
uses: actions/cache/save@v4
329+
uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
330330
if: steps.ccm-cache.outputs.cache-hit != 'true'
331331
with:
332332
path: ~/.ccm/scylla-repository
@@ -346,21 +346,21 @@ jobs:
346346
cp --parents ./**/target/*-reports/*.xml scylla-${{ matrix.scylla-version }}/
347347
348348
- name: Upload test results
349-
uses: actions/upload-artifact@v4
349+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
350350
if: steps.run-integration-tests.outcome == 'failure'
351351
with:
352352
name: test-results-${{ matrix.java-version }}-${{ matrix.scylla-version }}
353353
path: "*/**/target/*-reports/*.xml"
354354

355355
- name: Upload CCM logs
356-
uses: actions/upload-artifact@v4
356+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
357357
if: failure()
358358
with:
359359
name: ccm-log-scylla-${{ matrix.java-version }}-${{ matrix.scylla-version }}
360360
path: /tmp/ccm*/ccm*/node*/logs/*
361361

362362
- name: Parse test results
363-
uses: mikepenz/action-junit-report@v5
363+
uses: mikepenz/action-junit-report@3585e9575db828022551b4231f165eb59a0e74e3 # v5.6.2
364364
if: always()
365365
with:
366366
check_name: Integration tests report for Scylla ${{ steps.scylla-version.outputs.value }}

‎CONTRIBUTING.md‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,3 +124,31 @@ sudo ifconfig lo0 alias 127.0.1.1 up
124124
sudo ifconfig lo0 alias 127.0.1.2 up
125125
...
126126
```
127+
128+
## Updating GitHub Actions workflows
129+
130+
GitHub Actions workflows in this repository pin all third-party actions to specific commit SHAs
131+
instead of mutable version tags (e.g. `@v5`). This is a supply chain security measure: tags can be
132+
moved to point to different commits, but a SHA is immutable.
133+
134+
The format used is:
135+
136+
```yaml
137+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
138+
```
139+
140+
There is no need to update workflow action versions on every release. Only do so when the current
141+
version has a known vulnerability or when a new feature is needed.
142+
143+
### How to update a pinned action
144+
145+
1. Go to the action's GitHub repository (e.g. `github.com/actions/checkout`).
146+
2. Navigate to the desired release tag (e.g. `v5.0.2`) via the Tags page.
147+
3. Copy the full 40-character commit SHA from that tag's commit page.
148+
4. Verify the commit is not an [impostor commit](https://www.chainguard.dev/unchained/what-the-fork-imposter-commits-in-github-actions-and-ci-cd):
149+
open the commit on GitHub and ensure there is **no** banner saying
150+
"This commit does not belong to any branch on this repository".
151+
5. Replace the SHA and version comment in all workflow files.
152+
6. Update the repository allowlist under
153+
`Settings -> Actions -> General -> Allow or block specified actions and reusable workflows`
154+
to include the new SHA.

0 commit comments

Comments
 (0)