ci: pin actions to commit shas - #3504
Open
Totara-thib wants to merge 1 commit into
Open
Conversation
A tag like @v4 or a branch like @master is a movable pointer: whoever controls the action repository can re-point it, and the next run executes whatever it points at with the job's credentials. The path that matters here is release.yml: its jobs create the release and upload the binaries people download, holding a contents write token while running third-party action code. This is exactly how the tj-actions/changed-files compromise spread (CVE-2025-30066). attest-build-provenance is already pinned by sha, this finishes the job for checkout and rust-toolchain with the same comment style. Every rust-toolchain site already passes an explicit toolchain input, so behavior is unchanged; each sha was resolved from the upstream repository and cross-checked against its tag.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hi, one commit, one logical change, found with the Plumber CLI (https://github.com/getplumber/plumber) and verified on master.
You already pin
actions/attest-build-provenanceby commit sha; this finishes the job foractions/checkoutanddtolnay/rust-toolchain, same comment style. The path that motivated it isrelease.yml: its jobs create the release and upload the binaries people download while holding a contents write token, and a tag like@v4or@masteris a movable pointer, whoever controls (or compromises) the action repo can re-point it and the next run executes their code. That is how the tj-actions/changed-files compromise spread in March 2025 (CVE-2025-30066): re-pointed version tags on a trusted action, and every tag-referenced use ran the payload on its next build, while sha-pinned refs were untouched.Every rust-toolchain site already passes an explicit
toolchain:input, so pinning@masterchanges nothing about which toolchain installs. Each sha was resolved from the upstream repo and cross checked against its tag, and both dependabot and renovate bump sha pins with the comment kept in sync if you ever want that automated.One heads up: if an Actions allowlist is configured in settings, patterns written against tags (like
owner/action@v4) stop matching once refs are shas and workflows refuse to start. Entries need theowner/action@*form.I can also open a PR which adds the tool to CI so this does not quietly drift back; that one is a bonus, this PR stands on its own.