Skip to content

CI: add check of GitHub Action pinned hashes against tag #1885

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dolmen merged 1 commit into from
May 13, 2026
+63 −1
Merged

CI: add check of GitHub Action pinned hashes against tag #1885

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 55 additions & 0 deletions .ci.ghactions.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
#!/usr/bin/env bash

# MIT License
#
# Copyright (c) 2026 Olivier Mengué and contributors.
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in all
# copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
# SOFTWARE.

#
# Verify that hashes of GitHub actions match the declared tag in attached comment.
#

set -euo pipefail

declare -A seen
status=0

for w in .github/workflows/*.yml
do
sed -n -e '/uses: / s!^ *-\{0,1\} uses: \([^@]*\)@\([0-9a-f][0-9a-f]*\) *# *\(v.*\)$!\1 \2 \3!p' "$w" | while read -r action hash tag
do
if (( ${seen["$action-$hash-$tag"]:-0} )); then
printf "\e[1;32m%s: %s@%s == %s\e[m\n" "$w" "$action" "$tag" "$hash"
continue
fi
seen["$action-$hash-$tag"]=1

if eval "$( curl -s -H "Accept: application/vnd.github+json" \
"https://api.github.com/repos/$action/commits/$tag" | jq -r '.sha == "'"$hash"'"' )"
then
printf "\e[1;32m%s: %s@%s == %s\e[m\n" "$w" "$action" "$tag" "$hash"
else
printf "\e[1;31m%s: %s@%s != %s\e[m\n" "$w" "$action" "$tag" "$hash"
status=1
fi
done
done

exit $status
9 changes: 8 additions & 1 deletion .github/workflows/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,8 @@ jobs:
- run: ./.ci.gofmt.sh
- run: ./.ci.govet.sh
- run: go test -v -race ./...
test:

test-old-go:
runs-on: ubuntu-latest
strategy:
matrix:
Expand All @@ -39,3 +40,9 @@ jobs:
with:
go-version: ${{ matrix.go_version }}
- run: go test -v -race ./...

check-actions-hashes:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- run: ./.ci.ghactions.sh
Copy link
Copy Markdown
Contributor

@alexandear alexandear May 13, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not use zizmor?

zizmor is a static analysis tool for GitHub Actions. It can find and fix many common security issues in typical GitHub Actions CI/CD setups.

Suggested change
- run: ./.ci.ghactions.sh
- uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
with:
advanced-security: false
annotations: true

See the real world example at https://github.com/golangci/golangci-lint/blob/0fffb1b46b3adbf5fd8e76b8e59a77e3d2724cb9/.github/workflows/pr-checks.yml#L32

Copy link
Copy Markdown
Collaborator

@ccoVeille ccoVeille May 13, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dolmen what are your thoughts here?

It's a good thing to rely on an external dependency that is community reviewed.

Here the code is not tested a future PR could introduce a small change that could break the feature of checking tags

zizmor is tested and maintained.

Also, we could use cooldown feature in dependabot also, trying to mitigate attacks

https://github.com/samber/cc-skills-golang/blob/main/skills%2Fgolang-modernize%2FSKILL.md

https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#cooldown-

Copy link
Copy Markdown
Collaborator Author

@dolmen dolmen May 13, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is a balance between adding external dependencies (which are supply chain risk) and what they bring.

At this point I prefer a simple shell script that anyone can audit (and run on its own dev environment) to trusting another external dependency as a Github Action. Even made by a security researcher who now works at OpenAI.

Copy link
Copy Markdown
Collaborator Author

@dolmen dolmen May 13, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is also the reason why I haven't proposed to enable SonarQube or Codecov like I have on some of my other projects: they give valuable insight, but also bring supply chain risks. And with 25k ⭐ , Testify is a high profile target.