Skip to content

Commit d81c708

Browse files
abueideclaude
abueide
and
claude
authored
fix(ci): pin GitHub Actions to commit SHAs for supply chain security (#83)
Mitigates tag-based supply chain attacks (e.g. Mini Shai-Hulud) by pinning all third-party actions to immutable commit SHAs instead of mutable version tags. Updates validate.sh to prefer SHA pinning. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
1 parent eedab48 commit d81c708

7 files changed

Lines changed: 37 additions & 34 deletions

File tree

‎.github/workflows/devbox-update.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,10 @@ jobs:
2323
contents: write
2424
pull-requests: write
2525
steps:
26-
- uses: actions/checkout@v6
26+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2727

2828
- name: Install devbox
29-
uses: jetify-com/devbox-install-action@v0.15.0
29+
uses: jetify-com/devbox-install-action@8c6a66ed6273138b1915457069de78cb52fe3bd7 # v0.15.0
3030

3131
- name: Update devbox packages
3232
run: |

‎.github/workflows/e2e-android.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ jobs:
4242
matrix:
4343
device: ${{ fromJSON(inputs.devices) }}
4444
steps:
45-
- uses: actions/checkout@v6
45+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
4646

4747
- name: Enable KVM
4848
run: |
@@ -51,7 +51,7 @@ jobs:
5151
sudo udevadm trigger --name-match=kvm
5252
5353
- name: Setup Gradle cache
54-
uses: actions/cache@v5
54+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
5555
with:
5656
path: |
5757
~/.gradle/caches
@@ -71,7 +71,7 @@ jobs:
7171
df -h /
7272
7373
- name: Install Devbox
74-
uses: jetify-com/devbox-install-action@v0.15.0
74+
uses: jetify-com/devbox-install-action@8c6a66ed6273138b1915457069de78cb52fe3bd7 # v0.15.0
7575
with:
7676
enable-cache: true
7777

@@ -125,7 +125,7 @@ jobs:
125125
126126
- name: Upload reports and logs
127127
if: always()
128-
uses: actions/upload-artifact@v7
128+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
129129
with:
130130
name: ${{ inputs.artifact-prefix }}-${{ matrix.device }}-reports
131131
path: |

‎.github/workflows/e2e-ios.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434
matrix:
3535
include: ${{ fromJSON(inputs.matrix-include) }}
3636
steps:
37-
- uses: actions/checkout@v6
37+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
3838

3939
- name: Select pinned Xcode
4040
if: matrix.device == 'max'
@@ -50,7 +50,7 @@ jobs:
5050
xcrun simctl list runtimes | grep -i ios
5151
5252
- name: Setup CocoaPods cache
53-
uses: actions/cache@v5
53+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
5454
with:
5555
path: |
5656
~/.cocoapods/repos
@@ -60,7 +60,7 @@ jobs:
6060
${{ runner.os }}-pods-
6161
6262
- name: Setup Xcode build cache
63-
uses: actions/cache@v5
63+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
6464
with:
6565
path: |
6666
~/Library/Developer/Xcode/DerivedData
@@ -69,7 +69,7 @@ jobs:
6969
${{ runner.os }}-xcode-
7070
7171
- name: Install Devbox
72-
uses: jetify-com/devbox-install-action@v0.15.0
72+
uses: jetify-com/devbox-install-action@8c6a66ed6273138b1915457069de78cb52fe3bd7 # v0.15.0
7373
with:
7474
enable-cache: true
7575

@@ -118,7 +118,7 @@ jobs:
118118
119119
- name: Upload reports and logs
120120
if: always()
121-
uses: actions/upload-artifact@v7
121+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
122122
with:
123123
name: ${{ inputs.artifact-prefix }}-${{ matrix.device }}-reports
124124
path: |

‎.github/workflows/e2e-react-native.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -26,17 +26,17 @@ jobs:
2626
matrix:
2727
include: ${{ fromJSON(inputs.matrix-include) }}
2828
steps:
29-
- uses: actions/checkout@v6
29+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
3030

3131
- name: Setup Node.js with cache
32-
uses: actions/setup-node@v6
32+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
3333
with:
3434
node-version: '20'
3535
cache: 'npm'
3636
cache-dependency-path: examples/react-native/package-lock.json
3737

3838
- name: Cache node_modules
39-
uses: actions/cache@v5
39+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
4040
with:
4141
path: examples/react-native/node_modules
4242
key: ${{ runner.os }}-node-modules-${{ hashFiles('examples/react-native/package-lock.json') }}
@@ -52,7 +52,7 @@ jobs:
5252
5353
- name: Setup Gradle cache (Android only)
5454
if: matrix.platform == 'android'
55-
uses: actions/cache@v5
55+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
5656
with:
5757
path: |
5858
~/.gradle/caches
@@ -77,7 +77,7 @@ jobs:
7777
7878
- name: Setup CocoaPods cache (iOS only)
7979
if: matrix.platform == 'ios'
80-
uses: actions/cache@v5
80+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
8181
with:
8282
path: |
8383
~/.cocoapods/repos
@@ -88,7 +88,7 @@ jobs:
8888
8989
- name: Setup Xcode build cache (iOS only)
9090
if: matrix.platform == 'ios'
91-
uses: actions/cache@v5
91+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
9292
with:
9393
path: |
9494
~/Library/Developer/Xcode/DerivedData
@@ -106,7 +106,7 @@ jobs:
106106
df -h /
107107
108108
- name: Install Devbox
109-
uses: jetify-com/devbox-install-action@v0.15.0
109+
uses: jetify-com/devbox-install-action@8c6a66ed6273138b1915457069de78cb52fe3bd7 # v0.15.0
110110
with:
111111
enable-cache: true
112112

@@ -157,7 +157,7 @@ jobs:
157157
158158
- name: Upload reports and logs
159159
if: always()
160-
uses: actions/upload-artifact@v7
160+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
161161
with:
162162
name: ${{ inputs.artifact-prefix }}-${{ matrix.platform }}-${{ matrix.device }}-reports
163163
path: |

‎.github/workflows/pr-checks.yml‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
shell: ${{ steps.filter.outputs.shell }}
2424
ci: ${{ steps.filter.outputs.ci }}
2525
steps:
26-
- uses: actions/checkout@v6
26+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2727
with:
2828
fetch-depth: 0
2929
- name: Detect changed paths
@@ -56,10 +56,10 @@ jobs:
5656
runs-on: ubuntu-24.04
5757
timeout-minutes: 5
5858
steps:
59-
- uses: actions/checkout@v6
59+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
6060

6161
- name: Install Devbox
62-
uses: jetify-com/devbox-install-action@v0.15.0
62+
uses: jetify-com/devbox-install-action@8c6a66ed6273138b1915457069de78cb52fe3bd7 # v0.15.0
6363
with:
6464
enable-cache: true
6565

@@ -74,10 +74,10 @@ jobs:
7474
runs-on: ubuntu-24.04
7575
timeout-minutes: 10
7676
steps:
77-
- uses: actions/checkout@v6
77+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
7878

7979
- name: Install Devbox
80-
uses: jetify-com/devbox-install-action@v0.15.0
80+
uses: jetify-com/devbox-install-action@8c6a66ed6273138b1915457069de78cb52fe3bd7 # v0.15.0
8181
with:
8282
enable-cache: true
8383

@@ -98,7 +98,7 @@ jobs:
9898

9999
- name: Upload logs
100100
if: always()
101-
uses: actions/upload-artifact@v7
101+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
102102
with:
103103
name: shell-script-test-logs
104104
path: reports/logs/
@@ -112,10 +112,10 @@ jobs:
112112
runs-on: ubuntu-24.04
113113
timeout-minutes: 10
114114
steps:
115-
- uses: actions/checkout@v6
115+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
116116

117117
- name: Install Devbox
118-
uses: jetify-com/devbox-install-action@v0.15.0
118+
uses: jetify-com/devbox-install-action@8c6a66ed6273138b1915457069de78cb52fe3bd7 # v0.15.0
119119
with:
120120
enable-cache: true
121121

@@ -131,7 +131,7 @@ jobs:
131131

132132
- name: Upload logs
133133
if: always()
134-
uses: actions/upload-artifact@v7
134+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
135135
with:
136136
name: device-config-test-logs
137137
path: reports/logs/
@@ -145,18 +145,18 @@ jobs:
145145
runs-on: ubuntu-24.04
146146
timeout-minutes: 10
147147
steps:
148-
- uses: actions/checkout@v6
148+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
149149

150150
- name: Remove system Rust toolchain
151151
run: rustup self uninstall -y || true
152152

153153
- name: Install Devbox
154-
uses: jetify-com/devbox-install-action@v0.15.0
154+
uses: jetify-com/devbox-install-action@8c6a66ed6273138b1915457069de78cb52fe3bd7 # v0.15.0
155155
with:
156156
enable-cache: true
157157

158158
- name: Cargo cache
159-
uses: actions/cache@v5
159+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
160160
with:
161161
path: |
162162
~/.cargo/registry

‎.github/workflows/release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
first_tag: ${{ steps.check.outputs.first_tag }}
1919
title: ${{ steps.check.outputs.title }}
2020
steps:
21-
- uses: actions/checkout@v6
21+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2222
with:
2323
fetch-depth: 0
2424

‎.github/workflows/validate.sh‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,9 +64,12 @@ for workflow in $WORKFLOW_FILES; do
6464
fi
6565

6666
# Check for common issues
67-
if grep -q "uses:.*@v[0-9]" "$workflow"; then
67+
if grep -q "uses:.*@[0-9a-f]\{40\}" "$workflow"; then
68+
SHA_PINNED=$(grep -c "uses:.*@[0-9a-f]\{40\}" "$workflow" | xargs)
69+
echo " ✓ Actions pinned to commit SHAs ($SHA_PINNED)"
70+
elif grep -q "uses:.*@v[0-9]" "$workflow"; then
6871
PINNED_ACTIONS=$(grep -o "uses:.*@v[0-9][0-9.]*" "$workflow" | wc -l | xargs)
69-
echo " ✓ Actions pinned to versions ($PINNED_ACTIONS)"
72+
echo " ⚠ Warning: Actions pinned to mutable tags ($PINNED_ACTIONS) - prefer commit SHA pinning"
7073
fi
7174

7275
# Check for timeout configuration

0 commit comments

Comments
 (0)