security: complete supply-chain hardening (#443)

* security: pin all GitHub Actions to SHA, harden supply chain

- Pin all `uses:` references to full SHA-256 commit hashes across
  workflows and Go templates (14 files, 30+ action references)
- Pin TykTechnologies/github-actions refs to @42304edda365365e0a887cf018d8edc34b960b82
- Add dependency-guard reusable workflow to release.yml PR builds
- Pin Dockerfile base image (debian:stable-slim) to digest
- Replace npm ci with npm install --ignore-scripts (goreleaser.yml, ai-studio-frontend-build)
- Add --no-deps to pip install commands (build-tat)
- Flag curl|bash patterns with TODO(security) comments

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add inline SECURITY markers to curl|bash lines in smoke-tests

The curl|bash invocations for packagecloud repo setup already had TODO
comments on preceding lines, but the security check grep requires the
marker on the same line. Added inline SECURITY annotations.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: buger

.github/workflows/pages.yml

@@ -26,24 +26,24 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-      
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff  # v5
         with:
           go-version: '1.22'
-          
+
       - name: Generate Static Site
         run: go run main.go policy generate-tui --config-dir config/tui --out-dir public
-        
+
       - name: Setup Pages
-        uses: actions/configure-pages@v5
-        
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b  # v5
+
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa  # v3
         with:
           path: './public'
-          
+
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e  # v4

.github/workflows/release.yml

@@ -11,31 +11,37 @@ on:
       - master
 
 jobs:
+  dep-guard:
+    if: github.event_name == 'pull_request'
+    uses: TykTechnologies/github-actions/.github/workflows/dependency-guard.yml@42304edda365365e0a887cf018d8edc34b960b82  # main
+
   goreleaser:
+    needs: [dep-guard]
+    if: always() && (needs.dep-guard.result == 'success' || needs.dep-guard.result == 'skipped')
     runs-on: ${{ vars.DEFAULT_RUNNER }}
     permissions:
       id-token: write
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff  # v5
         with:
           go-version: "1.22"
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3
 
       - run: make test
 
-      - uses: docker/login-action@v3
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9  # v3
         if: startsWith(github.ref, 'refs/tags/')
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
-      - uses: goreleaser/goreleaser-action@v6
+      - uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a  # v6
         with:
           version: "~> v2"
           args: release --clean ${{ !startsWith(github.ref, 'refs/tags/') && '--snapshot' || '' }}
@@ -48,7 +54,7 @@ jobs:
           path=$(jq -rc '.[] | select((.type=="Binary") and (.goos=="linux") and .goarch=="amd64") | .path' dist/artifacts.json)
           echo "path=${path}" >> $GITHUB_OUTPUT
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         with:
           name: binary-amd64
           path: ${{ steps.binary.outputs.path }}
@@ -75,15 +81,15 @@ jobs:
 
     steps:
       - name: checkout ${{matrix.repo}}/${{matrix.branch}}
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
         with:
           repository: ${{ matrix.owner }}/${{ matrix.repo }}
           ref: ${{ matrix.branch }}
           token: ${{ secrets.ORG_GH_TOKEN }}
           path: ${{ matrix.repo }}
           fetch-depth: 1
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
         id: download
         with:
           name: binary-amd64

Dockerfile

@@ -1,5 +1,6 @@
-FROM debian:stable-slim
+FROM debian:stable-slim@sha256:99fc6d2a0882fcbcdc452948d2d54eab91faafc7db037df82425edcdcf950e1f
 RUN apt-get update && apt-get dist-upgrade -y git curl
+# TODO(security): curl piped to shell - consider pre-downloading and verifying checksum
 RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg -o /usr/share/keyrings/githubcli-archive-keyring.gpg \
     && chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg \
     && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list > /dev/null \

policy/templates/nightly-e2e/.github/workflows/nightly-e2e-tests.yml

@@ -41,18 +41,18 @@ jobs:
       id-token: write # This is required for requesting the Github JWT
       contents: read # This is required for actions/checkout
     steps:
-      - uses: aws-actions/configure-aws-credentials@v4
+      - uses: aws-actions/configure-aws-credentials@ff717079ee2060e4bcee96c4779b553acc87447c  # v4
         with:
           role-to-assume: arn:aws:iam::754489498669:role/ecr_rw_tyk
           role-session-name: cipush
           aws-region: eu-central-1
       - id: ecr
-        uses: aws-actions/amazon-ecr-login@v2
+        uses: aws-actions/amazon-ecr-login@f2e9fc6c2b355c1890b65e6f6f0e2ac3e6e22f78  # v2
         with:
           mask-password: 'true'
       - name: Run Trivy vulnerability scanner for dashboard
         id: trivy_dashboard
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1  # master
         with:
           image-ref: "754489498669.dkr.ecr.eu-central-1.amazonaws.com/tyk-analytics:{{`${{ github.event.inputs.dashboard_image_tag || 'master' }}`}}"
           format: 'table'
@@ -65,7 +65,7 @@ jobs:
       - name: Run Trivy vulnerability scanner for gateway
         if: always()
         id: trivy_gateway
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1  # master
         with:
           image-ref: "754489498669.dkr.ecr.eu-central-1.amazonaws.com/tyk-ee:{{`${{ github.event.inputs.gateway_image_tag || 'master' }}`}}"
           format: 'table'
@@ -78,7 +78,7 @@ jobs:
       - name: Run Trivy vulnerability scanner for MDCB
         if: always()
         id: trivy_mdcb
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1  # master
         with:
           image-ref: "754489498669.dkr.ecr.eu-central-1.amazonaws.com/tyk-sink:{{`${{ github.event.inputs.mdcb_image_tag || 'master' }}`}}"
           format: 'table'
@@ -90,7 +90,7 @@ jobs:
           skip-update: false
       - name: Send Slack notification
         if: failure() && (steps.trivy_dashboard.outcome != 'success' || steps.trivy_gateway.outcome != 'success' || steps.trivy_mdcb.outcome != 'success')
-        uses: slackapi/slack-github-action@v1.25.0
+        uses: slackapi/slack-github-action@6c661ce58804a1a20f6dc5fbee7f0381b469e001  # v1.25.0
         with:
           channel-id: '#team-ext-engineering-pr-notifications'
           slack-message: |
@@ -118,7 +118,7 @@ jobs:
       contents: read
     steps:
       - name: Upload failed job logs
-        uses: TykTechnologies/github-actions/.github/actions/gh-logs-analyser@main
+        uses: TykTechnologies/github-actions/.github/actions/gh-logs-analyser@42304edda365365e0a887cf018d8edc34b960b82  # main
         with:
           github_token: ${{`{{ secrets.GITHUB_TOKEN }}`}}
           gh_logs_analyser_token: ${{`{{ secrets.GH_LOGS_ANALYSER }}`}}

policy/templates/releng/.github/workflows/release.yml

@@ -61,7 +61,7 @@ jobs:
 
   sbom:
     needs: goreleaser
-    uses: TykTechnologies/github-actions/.github/workflows/sbom.yaml@main
+    uses: TykTechnologies/github-actions/.github/workflows/sbom.yaml@42304edda365365e0a887cf018d8edc34b960b82  # main
     secrets:
       DEPDASH_URL: ${{`{{ secrets.DEPDASH_URL }}`}}
       DEPDASH_KEY: ${{`{{ secrets.DEPDASH_KEY }}`}}
@@ -77,7 +77,7 @@ jobs:
       contents: read
     steps:
       - name: Upload failed job logs
-        uses: TykTechnologies/github-actions/.github/actions/gh-logs-analyser@main
+        uses: TykTechnologies/github-actions/.github/actions/gh-logs-analyser@42304edda365365e0a887cf018d8edc34b960b82  # main
         with:
           github_token: ${{`{{ secrets.GITHUB_TOKEN }}`}}
           gh_logs_analyser_token: ${{`{{ secrets.GH_LOGS_ANALYSER }}`}}

policy/templates/releng/.github/workflows/release.yml.d/ai-studio-frontend-build.gotmpl

@@ -6,7 +6,7 @@
       frontend_built: {{`${{ steps.build.outputs.frontend_built }}`}}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
         with:
           fetch-depth: 0
   {{- if eq .Name "tyk-analytics" }}
@@ -16,7 +16,7 @@
   {{- end }}
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
         with:
           node-version: '18'
           cache: 'npm'
@@ -28,12 +28,12 @@
           CI: false
         run: |
           cd ui/admin-frontend
-          npm ci
+          npm install --ignore-scripts
           npm run build
           echo "frontend_built=true" >> $GITHUB_OUTPUT
 
       - name: Upload frontend build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         with:
           name: frontend-build
           path: ui/admin-frontend/build

policy/templates/releng/.github/workflows/release.yml.d/aws.gotmpl

@@ -13,11 +13,11 @@
 
     steps:
       - name: Checkout {{ .Name }}
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
         with:
           fetch-depth: 1
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
         with:
           name: rpm
           path: aws
@@ -48,11 +48,11 @@
 
     steps:
       - name: Checkout {{ .Name }}
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
         with:
           fetch-depth: 1
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
         with:
           name: payg
           path: aws

policy/templates/releng/.github/workflows/release.yml.d/goreleaser.gotmpl

@@ -52,7 +52,7 @@
 
     steps:
       - name: Checkout of {{ .Name }}
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
         with:
           fetch-depth: 1
   {{- if eq .Name "tyk-analytics" }}
@@ -85,7 +85,7 @@
 
 {{- if has "ai-studio-frontend-build" .Branchvals.Features }}
       - name: Download frontend build artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
         with:
           name: frontend-build
           path: ui/admin-frontend/build
@@ -106,40 +106,40 @@
           echo "commit_author=$(git show -s --format='%ae' HEAD)" >> $GITHUB_OUTPUT
           echo "branch=${HEAD_REF##*/}" >> $GITHUB_OUTPUT
 
-      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130  # v3
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3
 
       - name: Login to DockerHub
         if: startsWith(github.ref, 'refs/tags')
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9  # v3
         with:
           username: {{`${{ secrets.DOCKER_USERNAME }}`}}
           password: {{`${{ secrets.DOCKER_PASSWORD }}`}}
 
       - name: Login to Cloudsmith
         if: startsWith(github.ref, 'refs/tags')
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9  # v3
         with:
           registry: docker.tyk.io
           username: {{`${{ secrets.CLOUDSMITH_USERNAME }}`}}
           password: {{`${{ secrets.CLOUDSMITH_API_KEY }}`}}
 
-      - uses: aws-actions/configure-aws-credentials@v4
+      - uses: aws-actions/configure-aws-credentials@ff717079ee2060e4bcee96c4779b553acc87447c  # v4
         with:
           role-to-assume: arn:aws:iam::754489498669:role/ecr_rw_tyk
           role-session-name: cipush
           aws-region: eu-central-1
           # Don't mask to pass it across job boundaries
           mask-aws-account-id: false
 
-      - uses: aws-actions/amazon-ecr-login@v2
+      - uses: aws-actions/amazon-ecr-login@f2e9fc6c2b355c1890b65e6f6f0e2ac3e6e22f78  # v2
         id: ecr
         if: {{`${{ matrix.golang_cross == '` }}{{.Branchvals.Buildenv}}{{`' }}`}}
         with:
           mask-password: 'true'
 
-      - uses: WarpBuilds/cache@v1
+      - uses: WarpBuilds/cache@f643a1ba29942d56621d07fc2d4284c7219868ad  # v1
         with:
           path: |
             ~/.cache/go-build
@@ -248,7 +248,7 @@
       - name: Docker metadata for {{ $b }} CI
         id: ci_metadata_{{ $b }}
         if: {{`${{ matrix.golang_cross == '` }}{{$r.Branchvals.Buildenv}}{{`' }}`}}
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051  # v5
         with:
           images: |
             {{printf "%s/%s" `${{ steps.ecr.outputs.registry }}` $bv.CIRepo}}
@@ -264,7 +264,7 @@
 
       - name: push {{ $b }} image to CI
         if: {{`${{ matrix.golang_cross == '` }}{{$r.Branchvals.Buildenv}}{{`' }}`}} {{/* push only main build variation */}}
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8  # v6
         with:
           context: {{ if has "ai-studio-frontend-build" $r.Branchvals.Features }}"."{{ else }}"dist"{{ end }}
           platforms: {{ $bv.GetDockerPlatforms | join "," }}
@@ -285,7 +285,7 @@
 
       - name: Docker metadata for {{ $b }} tag push
         id: tag_metadata_{{ $b }}
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051  # v5
         with:
           images: |
           {{- range $image :=  $bv.GetImages "DHRepo" "CSRepo" }}
@@ -305,7 +305,7 @@
 
       - name: push {{ $b }} image to prod
         if: {{`${{ matrix.golang_cross == '` }}{{$r.Branchvals.Buildenv}}{{`' }}`}} {{/* push only main build variation */}}
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8  # v6
         with:
           context: {{ if has "ai-studio-frontend-build" $r.Branchvals.Features }}"."{{ else }}"dist"{{ end }}
           platforms: {{ $bv.GetDockerPlatforms | join "," }}
@@ -326,7 +326,7 @@
 {{ end }} {{/* range getDockerBuilds */}}
 
       - name: save deb
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         if: {{`${{ matrix.golang_cross == '` }}{{.Branchvals.Buildenv}}{{`' }}`}}
         with:
           name: deb
@@ -337,7 +337,7 @@
             !dist/*fips*.deb
 
       - name: save rpm
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         if: {{`${{ matrix.golang_cross == '` }}{{.Branchvals.Buildenv}}{{`' }}`}}
         with:
           name: rpm