fix: pin unpinned GitHub Actions to commit SHAs#14453
fix: pin unpinned GitHub Actions to commit SHAs#14453dagecko wants to merge 1 commit intoTheAlgorithms:masterfrom
Conversation
Automated security fixes applied by Runner Guard (https://github.com/Vigilant-LLC/runner-guard). Changes: .github/workflows/build.yml | 2 +- .github/workflows/devcontainer_ci.yml | 2 +- .github/workflows/directory_writer.yml | 4 +++- .github/workflows/project_euler.yml | 4 ++-- .github/workflows/ruff.yml | 2 +- .github/workflows/sphinx.yml | 2 +- 6 files changed, 9 insertions(+), 7 deletions(-)
algorithms-keeper
bot
added
enhancement
| - run: sudo apt-get update && sudo apt-get install -y libhdf5-dev | ||
| - uses: actions/checkout@v6 | ||
| - uses: astral-sh/setup-uv@v7 | ||
| - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 |
There was a problem hiding this comment.
The comment is # v7, whereas the current version is v7.6.0, so if you are going to pin to the latest version, then comment needs to match.
v7 allows GitHub Actions to run the latest-and-greatest 7.x.y version trusting Astral's Semantic Versioning. If we are going to pin to a particular version, then Dependabot will generate a ton more pull requests.
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - uses: devcontainers/ci@v0.3 | ||
| - uses: devcontainers/ci@8bf61b26e9c3a98f69cb6ce2f88d24ff59b785c6 # v0.3 |
There was a problem hiding this comment.
The comment is # v0.3, whereas the current version is v0.3.1900000417, so if you are going to pin to the latest version, then comment needs to match.
v0.3 allows GitHub Actions to run the latest-and-greatest 0.3.y version trusting devcontainers' Semantic Versioning. If we are going to pin to a particular version, then Dependabot will generate a ton more pull requests.
| git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/$GITHUB_REPOSITORY | ||
| git remote set-url origin https://x-access-token:${GITHUB_TOKEN}@github.com/$GITHUB_REPOSITORY | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
There was a problem hiding this comment.
Does GitHub recommend this in their docs?
algorithms-keeper
bot
added
awaiting changes
2 participants
Describe your change:
Hey, we found some CI/CD security issues in this repo's GitHub Actions workflows. Specifically, several third-party actions are referenced by mutable version tags instead of pinned commit SHAs, which makes them vulnerable to supply chain attacks (the same class of vulnerability exploited in the recent tj-actions, Trivy, and LiteLLM attack chain). This PR pins them to immutable SHAs.
Checklist:
There's a real person behind this PR. If you have any questions just drop them here and we'll respond.
Found by Runner Guard | Vigilant