Pin GitHub Actions to commit SHAs and let Dependabot update them#38
Open
tas50 wants to merge 1 commit into
Open
Pin GitHub Actions to commit SHAs and let Dependabot update them#38tas50 wants to merge 1 commit into
tas50 wants to merge 1 commit into
Conversation
The workflows referenced actions by mutable major tags, which had also drifted out of sync (checkout was @v6 in ci.yml and @v4 in lint.yml). A tag can be repointed at malicious code after review, so pin every action to a full-length commit SHA (the only immutable reference) at its current latest release, with a version comment for readability: - actions/checkout -> v7.0.0 - ruby/setup-ruby -> v1.314.0 - r7kamura/rubocop-problem-matchers-action -> v1.2.2 Add a github-actions ecosystem to Dependabot so these SHAs are bumped automatically as new releases ship, and add a 7-day cooldown to both ecosystems so freshly published versions are not adopted immediately. Signed-off-by: Tim Smith <tsmith84@proton.me>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hardens and modernizes the GitHub Actions pinning, and sets up Dependabot to keep it current.
Pin actions to commit SHAs
Both workflows referenced actions by mutable major tags, which had also drifted out of sync —
actions/checkoutwas@v6inci.ymlbut@v4inlint.yml. A tag can be force-pushed to point at new code after a maintainer (or attacker) changes it, so a tag is not an immutable pin. Each action is now pinned to a full-length commit SHA at its current latest release, with a trailing version comment:actions/checkout9c091bb…ruby/setup-ruby9eb537c…r7kamura/rubocop-problem-matchers-action59f1a07…Keep them updated with Dependabot
Added a
github-actionsecosystem to.github/dependabot.yml. Dependabot understands SHA-pinned actions and will open PRs that bump both the SHA and the version comment as new releases ship, so pinning no longer means going stale.Cooldown
Added a 7-day
cooldownto both the existingbundlerecosystem and the newgithub-actionsecosystem, so Dependabot waits a week before proposing newly published versions — a guard against pulling in a freshly compromised or unstable release.Notes
lint.yml, which is also modified by Run cookstyle via Bundler in CI and fix rubocop target Ruby #34 (cookstyle-via-bundler). Whichever merges first, the other will need a trivial rebase on theuses:lines.