From edf5691417c5480adea3ab1c444877f9999aa52e Mon Sep 17 00:00:00 2001 From: StepSecurity Bot Date: Wed, 9 Apr 2025 09:24:58 -0700 Subject: [PATCH] [StepSecurity] ci: Harden GitHub Actions (#597) ## Summary This pull request is created by [StepSecurity](https://app.stepsecurity.io/securerepo) at the request of @bigdaz. Please merge the Pull Request to incorporate the requested changes. Please tag @bigdaz on your message if you have any questions related to the PR. ## Security Fixes ### Pinned Dependencies GitHub Action tags and Docker tags are mutable. This poses a security risk. GitHub's Security Hardening guide recommends pinning actions to full length commit. - [GitHub Security Guide](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions) - [The Open Source Security Foundation (OpenSSF) Security Guide](https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies) ## Feedback For bug reports, feature requests, and general feedback; please email support@stepsecurity.io. To create such PRs, please visit https://app.stepsecurity.io/securerepo. Signed-off-by: StepSecurity Bot Signed-off-by: StepSecurity Bot --- .github/workflows/ci-update-dist.yml | 2 +- .github/workflows/integ-test-dependency-graph.yml | 2 +- .github/workflows/update-checksums-file.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci-update-dist.yml b/.github/workflows/ci-update-dist.yml index d4c088f..56a043b 100644 --- a/.github/workflows/ci-update-dist.yml +++ b/.github/workflows/ci-update-dist.yml @@ -54,7 +54,7 @@ jobs: cp -r sources/dist . - name: Import GPG key to sign commits - uses: crazy-max/ghaction-import-gpg@v6 + uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6.3.0 with: gpg_private_key: ${{ secrets.GH_BOT_PGP_PRIVATE_KEY }} passphrase: ${{ secrets.GH_BOT_PGP_PASSPHRASE }} diff --git a/.github/workflows/integ-test-dependency-graph.yml b/.github/workflows/integ-test-dependency-graph.yml index 6c8fadf..9f6aa57 100644 --- a/.github/workflows/integ-test-dependency-graph.yml +++ b/.github/workflows/integ-test-dependency-graph.yml @@ -178,7 +178,7 @@ jobs: runs-on: "ubuntu-latest" steps: - name: Download dependency-graph artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1 with: path: downloaded-dependency-graphs pattern: dependency-graph_*dependency-graph-generate-submit-and-upload.json diff --git a/.github/workflows/update-checksums-file.yml b/.github/workflows/update-checksums-file.yml index 3efec3d..2ae67f4 100644 --- a/.github/workflows/update-checksums-file.yml +++ b/.github/workflows/update-checksums-file.yml @@ -38,7 +38,7 @@ jobs: working-directory: sources - name: Import GPG key to sign commits - uses: crazy-max/ghaction-import-gpg@v6 + uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6.3.0 with: gpg_private_key: ${{ secrets.GH_BOT_PGP_PRIVATE_KEY }} passphrase: ${{ secrets.GH_BOT_PGP_PASSPHRASE }}