Skip to content

TT-17509: Update s1-cns-scan.yml workflow references #420

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
asutosh merged 1 commit into from
Aug 13, 2026
Merged

TT-17509: Update s1-cns-scan.yml workflow references #420

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/nightly-security-scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,12 +20,12 @@

s1-scan:
name: SentinelOne CNS Scan
uses: TykTechnologies/github-actions/.github/workflows/s1-cns-scan.yml@78124512432a6f63372529cecbbbf58bf0411fa5 # main
uses: TykTechnologies/github-actions/.github/workflows/s1-cns-scan.yml@production
permissions:

Check warning on line 24 in .github/workflows/nightly-security-scan.yml

View check run for this annotation

probelabs / Visor: security

security Issue 

The reusable workflow is pinned to a mutable tag (`@production`) instead of an immutable commit SHA. This practice introduces a supply-chain risk. If the `production` tag in the `TykTechnologies/github-actions` repository is maliciously or accidentally moved to a different commit, this workflow will execute unintended code. This could lead to compromised builds, data exfiltration, or other security breaches within the CI/CD pipeline.
Raw output 
For maximum security and build reproducibility, pin the reusable workflow to a specific commit SHA. The previous version of this file correctly used a commit SHA (`78124512432a6f63372529cecbbbf58bf0411fa5`). If an update is intended, determine the full commit SHA that the `@production` tag points to and use that SHA directly.

Check warning on line 24 in .github/workflows/nightly-security-scan.yml

View check run for this annotation

probelabs / Visor: architecture

architecture Issue 

The reusable workflow is pinned to the mutable '@production' tag instead of an immutable commit SHA. While this allows for automatic updates, it can lead to unexpected workflow failures or behavior changes if breaking changes are pushed to the 'production' branch. This practice reduces the security and reproducibility of the workflow.
Raw output 
For improved security and build stability, pin the workflow to a specific commit SHA. If using a tag is a deliberate choice for maintainability, ensure there is a strict process for managing the 'production' tag to prevent introducing breaking changes.
contents: read
with:
iac_enabled: false
tag: service:vulnscan
policy_id: ${{ vars.S1_POLICY_ID }}
scope_type: ACCOUNT
secrets:
S1_API_TOKEN: ${{ secrets.S1_API_TOKEN }}
Expand Down
Loading