Pin GH Actions to commit sha#144
Conversation
Related to: harvester/harvester#10279 Signed-off-by: Volker Theile <vtheile@suse.com>
There was a problem hiding this comment.
Pull request overview
Pins third-party GitHub Actions used by this repository’s CI/security workflows to immutable commit SHAs to reduce supply-chain risk and improve build reproducibility (ref. harvester/harvester#10279).
Changes:
- Pin
actions/checkout, Docker Buildx/QEMU/login/build-push actions in the reusable build workflow to commit SHAs. - Pin Trivy scanning and SARIF upload actions to commit SHAs.
- Pin vault-secret read and FOSSA scan actions, plus CodeQL actions, to commit SHAs.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| .github/workflows/template-build.yml | Pins build/publish workflow actions (checkout, QEMU/Buildx, vault secrets, Docker login/build) to SHAs. |
| .github/workflows/scan.yml | Pins Trivy scan workflow actions (checkout, trivy-action, upload-sarif) to SHAs. |
| .github/workflows/fossa.yml | Pins vault secret reader and FOSSA action to SHAs. |
| .github/workflows/codeql-analysis.yml | Pins CodeQL workflow actions (checkout + codeql init/autobuild/analyze) to SHAs. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | ||
|
|
||
| - name: Download Rancher's VEX Hub report | ||
| run: curl -fsSO https://raw.githubusercontent.com/rancher/vexhub/refs/heads/main/reports/rancher.openvex.json |
There was a problem hiding this comment.
The VEX report is downloaded from the main branch (refs/heads/main), which makes this workflow non-reproducible and introduces a supply-chain risk (the file contents can change without review). Consider pinning the URL to a specific commit SHA or a versioned release tag, or vendoring the report into the repo and updating it explicitly.
| run: curl -fsSO https://raw.githubusercontent.com/rancher/vexhub/refs/heads/main/reports/rancher.openvex.json | |
| run: curl -fsSO https://raw.githubusercontent.com/rancher/vexhub/2e6b9b0e4c2f5c8a4f7d3a3b0e1c9d8f7a6b5c4d/reports/rancher.openvex.json |
|
@Mergifyio backport v1.8 |
✅ Backports have been createdDetails
|
ibrokethecloud
merged commit 85d0a5b
into
harvester:pin-ci-actions-to-sha
Related to: harvester/harvester#10279
IMPORTANT: Please do not create a Pull Request without creating an issue first.
Problem:
Solution:
Related Issue:
Test plan: