Pin workflow actions and fix the codeql-action advisory exposure - #2553
Open
Totara-thib wants to merge 3 commits into
Open
Pin workflow actions and fix the codeql-action advisory exposure#2553Totara-thib wants to merge 3 commits into
Totara-thib wants to merge 3 commits into
Conversation
The release path runs goreleaser with a token that can create releases, and the docker push workflow logs into Docker Hub with the registry credentials. Every action in those workflows was referenced by a mutable tag, and whoever controls an action repository can point a tag at different code after the fact. The tj-actions/changed-files incident (CVE-2025-30066) rewrote tags exactly this way to leak CI secrets. A commit SHA cannot be retargeted. This also settles the codeql-action refs, where v2 resolves as both a tag and a branch upstream and which revision runs is ambiguous. The projectdiscovery/actions pins cover the org's own actions for consistency, happy to drop those hunks if you prefer trusting the org namespace. Each pin keeps the version as a trailing comment for review, versions stay exactly where they were, and dependabot bumps SHA pins the same way it bumps tags today.
Five workflows ran with the repository's default token grants. Only the release workflow writes through the GitHub token, goreleaser creates the release and uploads the binaries, so it keeps contents write. The test and docker workflows drop to read only, the Docker Hub push authenticates with its own registry credentials and never needs the GitHub token.
The v2 releases from 2.26.11 on are in the range of GHSA-vqf5-2xx6-9wfm, the CodeQL debug artifacts could contain the GitHub PAT, and no fixed v2 release exists, the fix shipped in 3.28.3. The v2 line is also deprecated. This moves the three codeql-action references to the current release, pinned by SHA like the rest.
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (10)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed changes
Three commits, nothing about how the workflows behave changes except one security bump.
projectdiscovery/actionspins are included for consistency, happy to drop those hunks if you prefer trusting your own org namespace.contents: write. The test and docker workflows drop to read only, the Docker Hub push authenticates with its own registry credentials.One heads-up: if the org restricts allowed actions with tag patterns like
owner/action@v2, those patterns stop matching SHA refs and workflows fail at startup, the fix isowner/action@*in that setting. Nothing to do if no such restriction is configured.Proof
Every SHA resolves to the exact tag named in its comment, verifiable on each action's releases page. All workflow files parse and the changes are ref-format only, except the codeql bump described above.
Checklist
Found and fixed by Plumber's analysis, reviewed and submitted by me.