Pin GitHub Actions to full-length commit SHAs - #2602
Conversation
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
|
Hey @OssSecurityBot 👋! We use semantic commit messages to streamline the release process. Examples of commit messages with semantic prefixes:
To test your commit locally, please follow our guild on building from source. |
There was a problem hiding this comment.
🟡 Not ready to approve
There are objective inconsistencies with the PR description (Dependabot “grouping” not configured) and a workflow formatting inconsistency in codeql.yml that should be aligned with established repo conventions.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Pull request overview
This PR hardens the repository’s GitHub Actions setup by replacing tag-based third‑party uses: references with full commit SHAs (improving supply-chain integrity and reproducibility), and updates Dependabot’s GitHub Actions update configuration.
Changes:
- Pinned multiple third-party actions in
.github/workflows/to full-length commit SHAs with version comments. - Updated CodeQL/Scorecards workflows to reference the same pinned CodeQL action SHA with a more specific version comment.
- Added a Dependabot
cooldownfor thegithub-actionsecosystem (and should also add grouping to match the PR description).
File summaries
| File | Description |
|---|---|
| .github/workflows/scorecards.yml | Updates CodeQL SARIF upload action comment to a specific version while remaining SHA-pinned. |
| .github/workflows/remove-old-issues.yml | Pins dwieeb/needs-reply action from a tag to a full commit SHA. |
| .github/workflows/codeql.yml | Updates CodeQL action references/comments; needs indentation cleanup for consistency with other workflows. |
| .github/workflows/check-semantic-prs.yaml | Pins semantic PR title check action to a full commit SHA. |
| .github/workflows/check-dead-links.yml | Pins Lychee action to a full commit SHA. |
| .github/workflows/add-triage-label.yml | Adds a version comment to an already SHA-pinned action. |
| .github/workflows/acknowledge-new-prs.yml | Pins peter-evans/create-or-update-comment to a full commit SHA. |
| .github/workflows/acknowledge-new-issues.yml | Pins peter-evans/create-or-update-comment to a full commit SHA. |
| .github/dependabot.yml | Adds cooldown for GitHub Actions updates; should add groups or adjust PR description to match behavior. |
Review details
Suppressed comments (1)
.github/workflows/codeql.yml:74
- Continuation of the
steps:indentation issue: the comment block and the final "Perform CodeQL Analysis" step should be indented understeps:to match the rest of the repo’s workflows and keep the YAML structure consistently formatted.
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
with:
category: "/language:${{matrix.language}}"
- Files reviewed: 9/9 changed files
- Comments generated: 2
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4 | ||
| uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 | ||
| with: | ||
| languages: ${{ matrix.language }} | ||
| # Explicitly set source-root to handle runner directory naming |
|
suspicious bot account - closing PR |
|
reopening pull request after confirmation from security team this bot is legit |
|
@copilot the fix it |
Summary
This PR pins GitHub Actions to full-length commit SHAs for improved security and reproducibility and adds a 7 day cooldown to Dependabot configuration for GitHub Actions.
Why?
Pinning actions to commit SHAs prevents supply-chain attacks where a tag could be moved to point to malicious code. This is a recommended security best practice per the GitHub Actions security hardening guide.
This change mitigates the risk of tag retargeting to malicious code as seen in incidents like the tj-actions/changed-files action compromise or codfish/semantic-release-action compromise and improves the integrity and reproducibility of the CI/CD pipeline.
What changed?
Action pinning: Third-party action references in
.github/workflows/that used mutable tag-based references (e.g.,actions/checkout@v4) have been updated to full-length commit SHAs with a version comment (e.g.,actions/checkout@<sha> # v4) using the pinact tool. References that were already pinned to a SHA, or that used immutable release tags, were left unchanged.Dependabot configuration:
.github/dependabot.ymlhas been updated to ensure agithub-actionspackage-ecosystem section is present with acooldownconfiguration (default-days: 7). This groups Dependabot PRs for GitHub Actions and enforces a minimum 7-day cooldown between updates. If the file did not exist, it was created. If agithub-actionssection already existed, only thecooldownblock was added or itsdefault-daysvalue was increased to 7 if it was lower. The 7-day cooldown provides a window for the community to detect and report compromised releases before they are automatically proposed as updates, reducing exposure to supply-chain attacks via newly published malicious versions.Is this safe to merge?
Yes. The pinned SHAs correspond to the same commits that the existing tags pointed to. No behavioral changes are introduced. You can verify the pinned SHA value using the GitHub REST API (e.g., the commit hash for
actions/checkout@v7can be found in theshaproperty in the JSON response forGET https://api.github.com/repos/actions/checkout/commits/v7).For more information, visit https://aka.ms/action-pinning