fix: harden GitHub action entrypoints

Author: berisher

.github/workflows/release.yml

@@ -14,7 +14,9 @@ env:
   CARGO_TERM_COLOR: always
 
 permissions:
+  attestations: write
   contents: write
+  id-token: write
 
 jobs:
   create-release:
@@ -137,6 +139,11 @@ jobs:
           $hash = (Get-FileHash -Algorithm SHA256 $artifactPath).Hash.ToLower()
           "$hash  ${{ matrix.asset_name }}" | Out-File -FilePath $checksumPath -Encoding ascii
 
+      - name: Attest release binary
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: ./target/${{ matrix.target }}/release/${{ matrix.artifact_name }}
+
       - name: Upload Release Asset
         uses: actions/upload-release-asset@v1
         env:

README.md

@@ -81,7 +81,9 @@ You can also pass raw arguments via `args`, which overrides other inputs:
 ```
 
 Set `version` to download a specific release tag, or `install_only: true` to
-just add the binary to `PATH` without running it.
+just add the binary to `PATH` without running it. When you pin the action to a
+branch, commit SHA, or local checkout, set `version` explicitly; the action
+does not fall back to `latest` unless you opt into that mutable release.
 
 To run a custom Atheris harness (see `python/examples/harness.py` for a starter
 template), use `mode: atheris` and provide a harness path:
@@ -94,6 +96,8 @@ template), use `mode: atheris` and provide a harness path:
     harness_args: "-max_total_time=60"
 ```
 
+`harness_args` is split on shell whitespace before being passed to the harness.
+
 ## Usage
 
 ### Generate a Single Pickle File

action.yml

@@ -10,7 +10,8 @@ inputs:
   version:
     description: >
       Release tag to download (e.g., v1.2.3). Defaults to the action ref if it
-      looks like a tag; otherwise uses the latest release.
+      looks like a tag. For branch, SHA, or local checkouts, set this
+      explicitly; use latest only if you want a mutable release.
     required: false
     default: ""
   args:
@@ -81,7 +82,7 @@ inputs:
     required: false
     default: ""
   harness_args:
-    description: Arguments passed to the harness script (atheris mode).
+    description: Whitespace-delimited arguments passed to the harness script (atheris mode).
     required: false
     default: ""
 
@@ -97,11 +98,13 @@ runs:
   using: composite
   steps:
     - name: Validate mode
+      env:
+        INPUT_MODE: ${{ inputs.mode }}
       shell: bash
       run: |
-        case "${{ inputs.mode }}" in
+        case "$INPUT_MODE" in
           cli|atheris) ;;
-          *) echo "Unsupported mode: ${{ inputs.mode }}" >&2; exit 1 ;;
+          *) echo "Unsupported mode: $INPUT_MODE" >&2; exit 1 ;;
         esac
 
     - id: install
@@ -150,13 +153,15 @@ runs:
 
     - name: Setup Python (atheris)
       if: ${{ inputs.mode == 'atheris' }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
       with:
         python-version: ${{ inputs.python_version }}
 
     - name: Install Rust toolchain (atheris)
       if: ${{ inputs.mode == 'atheris' }}
-      uses: dtolnay/rust-toolchain@stable
+      uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7
+      with:
+        toolchain: stable
 
     - name: Run Atheris harness
       if: ${{ inputs.mode == 'atheris' }}

scripts/action-atheris.sh

@@ -7,11 +7,32 @@ if [[ -z "$harness_input" ]]; then
   exit 1
 fi
 
-workspace="${GITHUB_WORKSPACE:-$PWD}"
+workspace_input="${GITHUB_WORKSPACE:-$PWD}"
+if ! workspace="$(realpath "$workspace_input")"; then
+  echo "Workspace not found: ${workspace_input}" >&2
+  exit 1
+fi
+
 if [[ "$harness_input" = /* ]]; then
-  harness_path="$harness_input"
+  harness_candidate="$harness_input"
+else
+  harness_candidate="${workspace}/${harness_input}"
+fi
+
+if ! harness_path="$(realpath "$harness_candidate")"; then
+  echo "Harness not found: ${harness_candidate}" >&2
+  exit 1
+fi
+
+if [[ "$workspace" == "/" ]]; then
+  workspace_prefix="/"
 else
-  harness_path="${workspace}/${harness_input}"
+  workspace_prefix="${workspace}/"
+fi
+
+if [[ "${harness_path:0:${#workspace_prefix}}" != "$workspace_prefix" ]]; then
+  echo "Harness must be within GITHUB_WORKSPACE: ${harness_path}" >&2
+  exit 1
 fi
 
 if [[ ! -f "$harness_path" ]]; then
@@ -23,18 +44,28 @@ python -m pip install --upgrade pip
 python -m pip install maturin atheris
 
 wheel_dir="${RUNNER_TEMP:-/tmp}/pickle-fuzzer-wheels"
+rm -rf "$wheel_dir"
 mkdir -p "$wheel_dir"
 
 pushd "${GITHUB_ACTION_PATH}" >/dev/null
 maturin build --release -o "$wheel_dir"
 popd >/dev/null
 
-python -m pip install "${wheel_dir}"/*.whl
+shopt -s nullglob
+wheels=("${wheel_dir}"/*.whl)
+shopt -u nullglob
+
+if [[ "${#wheels[@]}" -ne 1 ]]; then
+  echo "Expected exactly one wheel in ${wheel_dir}, found ${#wheels[@]}" >&2
+  exit 1
+fi
+
+python -m pip install "${wheels[0]}"
 
 if [[ -n "${INPUT_HARNESS_ARGS:-}" ]]; then
-  echo "Running harness: ${harness_path} ${INPUT_HARNESS_ARGS}"
-  # shellcheck disable=SC2086
-  python "${harness_path}" ${INPUT_HARNESS_ARGS}
+  IFS=$' \t\n' read -r -a harness_args <<< "${INPUT_HARNESS_ARGS}"
+  echo "Running harness: ${harness_path} ${harness_args[*]}"
+  python "${harness_path}" "${harness_args[@]}"
 else
   echo "Running harness: ${harness_path}"
   python "${harness_path}"

scripts/action-install.sh

@@ -2,16 +2,53 @@
 set -euo pipefail
 
 repo="cisco-ai-defense/pickle-fuzzer"
+signer_workflow="${repo}/.github/workflows/release.yml"
 
 version_input="${INPUT_VERSION:-}"
 action_ref="${GITHUB_ACTION_REF:-}"
 
+is_safe_release_tag() {
+  [[ "$1" =~ ^v[0-9A-Za-z][0-9A-Za-z._+-]*$ ]]
+}
+
 if [[ -n "$version_input" ]]; then
   version="$version_input"
-elif [[ -n "$action_ref" && "$action_ref" == v* ]]; then
-  version="$action_ref"
+  version_source="inputs.version"
+elif [[ -n "$action_ref" && ( "$action_ref" == v* || "$action_ref" == refs/tags/v* ) ]]; then
+  version="${action_ref##refs/tags/}"
+  version_source="GITHUB_ACTION_REF"
 else
-  version="latest"
+  echo "INPUT_VERSION is required when the action ref is not a release tag." >&2
+  if [[ -n "$action_ref" ]]; then
+    echo "Received GITHUB_ACTION_REF=${action_ref}." >&2
+  else
+    echo "Received an empty GITHUB_ACTION_REF (for example from a local checkout)." >&2
+  fi
+  echo "Set the action version input to an immutable release tag such as v1.2.3, or explicitly set it to latest if you accept a mutable release." >&2
+  exit 1
+fi
+
+if [[ "$version" != "latest" ]] && ! is_safe_release_tag "$version"; then
+  echo "Unsupported release tag from ${version_source}: ${version}" >&2
+  echo "Expected a release tag like v1, v1.2.3, or v1.2.3-rc1." >&2
+  exit 1
+fi
+
+if ! command -v gh >/dev/null 2>&1; then
+  echo "GitHub CLI is required to resolve and verify release provenance." >&2
+  exit 1
+fi
+
+if [[ "$version" == "latest" ]]; then
+  version="$(gh release view --repo "${repo}" --json tagName --jq '.tagName')"
+  if [[ -z "$version" ]]; then
+    echo "Failed to resolve the latest release tag for ${repo}." >&2
+    exit 1
+  fi
+  if ! is_safe_release_tag "$version"; then
+    echo "Resolved latest release tag is invalid: ${version}" >&2
+    exit 1
+  fi
 fi
 
 os="${RUNNER_OS:-}"
@@ -61,52 +98,22 @@ else
 fi
 mkdir -p "$install_dir"
 
-if [[ "$version" == "latest" ]]; then
-  url="https://github.com/${repo}/releases/latest/download/${asset}"
-  checksum_url="https://github.com/${repo}/releases/latest/download/${asset}.sha256"
-else
-  url="https://github.com/${repo}/releases/download/${version}/${asset}"
-  checksum_url="https://github.com/${repo}/releases/download/${version}/${asset}.sha256"
-fi
+url="https://github.com/${repo}/releases/download/${version}/${asset}"
 
 echo "Downloading ${url}"
 curl -fsSL -o "${install_dir}/${bin_name}" "$url"
 
-checksum_path="${install_dir}/${asset}.sha256"
-echo "Downloading ${checksum_url}"
-curl -fsSL -o "${checksum_path}" "$checksum_url"
-
-expected_checksum="$(awk '{print $1}' "$checksum_path" | tr '[:upper:]' '[:lower:]')"
-if [[ -z "$expected_checksum" ]]; then
-  echo "Checksum file is empty or invalid: ${checksum_path}" >&2
-  exit 1
-fi
-
-if command -v sha256sum >/dev/null 2>&1; then
-  actual_checksum="$(sha256sum "${install_dir}/${bin_name}" | awk '{print $1}')"
-elif command -v shasum >/dev/null 2>&1; then
-  actual_checksum="$(shasum -a 256 "${install_dir}/${bin_name}" | awk '{print $1}')"
-elif command -v certutil >/dev/null 2>&1; then
-  file_native="${install_dir}/${bin_name}"
-  if command -v cygpath >/dev/null 2>&1; then
-    file_native="$(cygpath -w "${install_dir}/${bin_name}")"
-  fi
-  actual_checksum="$(certutil -hashfile "$file_native" SHA256 | awk 'NR==2 {print tolower($1)}')"
-else
-  echo "No SHA-256 tool available to verify checksum." >&2
-  exit 1
-fi
-
-actual_checksum="$(echo "$actual_checksum" | tr '[:upper:]' '[:lower:]')"
-if [[ -z "$actual_checksum" ]]; then
-  echo "Failed to compute SHA-256 checksum." >&2
-  exit 1
-fi
-
-if [[ "$expected_checksum" != "$actual_checksum" ]]; then
-  echo "Checksum mismatch for ${bin_name}." >&2
-  echo "Expected: ${expected_checksum}" >&2
-  echo "Actual:   ${actual_checksum}" >&2
+verify_args=(
+  attestation verify
+  "${install_dir}/${bin_name}"
+  --repo "${repo}"
+  --signer-workflow "${signer_workflow}"
+  --source-ref "refs/tags/${version}"
+)
+
+echo "Verifying release provenance for ${bin_name}"
+if ! gh "${verify_args[@]}" >/dev/null; then
+  echo "Failed to verify GitHub release provenance for ${bin_name}." >&2
   exit 1
 fi
 

scripts/action-run.sh

@@ -8,8 +8,74 @@ is_true() {
   esac
 }
 
+to_posix_path() {
+  local path="${1:-}"
+  if command -v cygpath >/dev/null 2>&1; then
+    case "$path" in
+      [A-Za-z]:[\\/]*|\\\\*)
+        cygpath -u "$path"
+        return
+        ;;
+      *)
+        printf '%s\n' "${path//\\//}"
+        return
+        ;;
+    esac
+  fi
+
+  printf '%s\n' "$path"
+}
+
+workspace_input="$(to_posix_path "${GITHUB_WORKSPACE:-$PWD}")"
+workspace="$(cd "$workspace_input" && pwd -P)"
+
+resolve_workspace_path() {
+  local input="$1"
+  local label="$2"
+  local normalized candidate parent leaf resolved_parent resolved
+
+  normalized="$(to_posix_path "$input")"
+  if [[ "$normalized" = /* ]]; then
+    candidate="$normalized"
+  else
+    candidate="${workspace}/${normalized}"
+  fi
+
+  if [[ -e "$candidate" || -L "$candidate" ]]; then
+    resolved="$(realpath "$candidate" 2>/dev/null)" || {
+      echo "Failed to resolve ${label}: ${input}" >&2
+      return 1
+    }
+  else
+    parent="$(dirname "$candidate")"
+    leaf="$(basename "$candidate")"
+    resolved_parent="$(cd "$parent" && pwd -P)" || {
+      echo "${label} parent directory does not exist: ${input}" >&2
+      return 1
+    }
+
+    if [[ "$leaf" == "." ]]; then
+      resolved="$resolved_parent"
+    else
+      resolved="${resolved_parent}/${leaf}"
+    fi
+  fi
+
+  case "$resolved" in
+    "$workspace"|"$workspace"/*)
+      printf '%s\n' "$resolved"
+      ;;
+    *)
+      echo "${label} must stay within GITHUB_WORKSPACE: ${input}" >&2
+      return 1
+      ;;
+  esac
+}
+
 if [[ -n "${INPUT_ARGS:-}" ]]; then
   echo "Running: pickle-fuzzer ${INPUT_ARGS}"
+  # Preserve the existing argv splitting for args without allowing glob expansion.
+  set -f
   # shellcheck disable=SC2086
   pickle-fuzzer ${INPUT_ARGS}
   exit 0
@@ -18,7 +84,8 @@ fi
 args=()
 
 if [[ -n "${INPUT_OUTPUT_DIR:-}" ]]; then
-  args+=(--dir "${INPUT_OUTPUT_DIR}")
+  output_dir="$(resolve_workspace_path "${INPUT_OUTPUT_DIR}" "output_dir")"
+  args+=(--dir "${output_dir}")
 fi
 
 if [[ -n "${INPUT_SAMPLES:-}" ]]; then
@@ -33,6 +100,16 @@ if [[ -n "${INPUT_SEED:-}" ]]; then
   args+=(--seed "${INPUT_SEED}")
 fi
 
+resolved_min_opcodes="${INPUT_MIN_OPCODES:-60}"
+resolved_max_opcodes="${INPUT_MAX_OPCODES:-300}"
+
+if [[ "${resolved_min_opcodes}" =~ ^[0-9]+$ && "${resolved_max_opcodes}" =~ ^[0-9]+$ ]]; then
+  if (( resolved_min_opcodes > resolved_max_opcodes )); then
+    echo "min_opcodes (${resolved_min_opcodes}) cannot exceed max_opcodes (${resolved_max_opcodes})." >&2
+    exit 1
+  fi
+fi
+
 if [[ -n "${INPUT_MIN_OPCODES:-}" ]]; then
   args+=(--min-opcodes "${INPUT_MIN_OPCODES}")
 fi
@@ -70,7 +147,9 @@ if [[ -n "${INPUT_OUTPUT_FILE:-}" ]]; then
     echo "Both output_dir and output_file were set; choose one." >&2
     exit 1
   fi
-  args+=("${INPUT_OUTPUT_FILE}")
+  output_file="$(resolve_workspace_path "${INPUT_OUTPUT_FILE}" "output_file")"
+  # Keep the positional FILE separate from greedy variadic options.
+  args+=(-- "${output_file}")
 fi
 
 if [[ ${#args[@]} -eq 0 ]]; then