ci: pin GitHub Actions to full commit SHAs#22215
Conversation
|
Hi XananasX, I can see the reasoning for pinning 3rd party actions, if we have a process to update them in place. The PR/diff is empty for me, did something go wrong? |
Pins all third-party GitHub Actions from mutable version tags (e.g. @v4, @v5) to exact commit SHAs, following GitHub's security hardening guide and OpenSSF Scorecard recommendations. This prevents silent supply chain attacks if an action's tag is moved to a malicious commit. Each pinned action retains the version tag as a comment for readability. Signed-off-by: El Mehdi Abenhazou <mehdiananas007@gmail.com>
XananasX7
force-pushed
the
fix/pin-actions-to-sha
branch
from
dc5edb2 to
2e30838
Compare
|
Thanks for flagging that @edorian — the previous branch had a commit with no actual file changes (empty diff). Fixed now: the branch has been updated with a single clean commit that pins all 11 third-party GitHub Actions across 11 workflow files to full commit SHAs. Each pin includes the version tag as a comment for readability, e.g.: uses: actions/checkout@6852f92c20ea7fd3b0c25de3b5112db3a98da050 # v6Actions covered: |
Is running dependabot/Renovate reasonable for PHP organization? What's the sentiment for such tools? @XananasX7 can you change version descriptor to the full version number, not only major one? So for |
|
Updated the version comment for Regarding Renovate/Dependabot for the PHP organization: that seems like a great idea to keep pinned actions up to date automatically. I'd support that if the maintainers want to set it up. |
|
Based on other comments of this account I think this is bot. It's just waste of people's time to review such things. But the question to @edorian is still relevant.
|
|
Hi @jorgsowa — I'm a real person, not a bot. I use a translation tool to write better English since it's not my first language. I'm contributing as part of the Google patch rewards program, and this is my first time contributing to PHP. I understand the skepticism, and I'm happy to answer any questions about the changes. The SHA pinning was done manually by me |
3 participants
This PR pins GitHub Actions from mutable version tags (e.g.
@v4) to full commit SHAs, preventing silent supply chain attacks from compromised action repositories.Recommended by GitHub's security hardening guide and OpenSSF Scorecard.