gradle/actions
1
0
Fork 0
mirror of https://github.com/gradle/actions.git synced 2025-04-16 15:59:18 +08:00
Code Issues Packages Projects Releases Wiki Activity

[StepSecurity] ci: Harden GitHub Actions (#597)

Browse Source 
## Summary

This pull request is created by
[StepSecurity](https://app.stepsecurity.io/securerepo) at the request of
@bigdaz. Please merge the Pull Request to incorporate the requested
changes. Please tag @bigdaz on your message if you have any questions
related to the PR.
## Security Fixes

### Pinned Dependencies

GitHub Action tags and Docker tags are mutable. This poses a security
risk. GitHub's Security Hardening guide recommends pinning actions to
full length commit.

- [GitHub Security
Guide](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions)
- [The Open Source Security Foundation (OpenSSF) Security
Guide](https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies)


## Feedback
For bug reports, feature requests, and general feedback; please email
support@stepsecurity.io. To create such PRs, please visit
https://app.stepsecurity.io/securerepo.


Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
This commit is contained in:
StepSecurity Bot 2025-04-09 09:24:58 -07:00 committed by GitHub
parent bf2c378a9b
commit edf5691417
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.github/workflows/ci-update-dist.yml vendored
View File

@ -54,7 +54,7 @@ jobs:
cp -r sources/dist . cp -r sources/dist .
- name: Import GPG key to sign commits - name: Import GPG key to sign commits
uses: crazy-max/ghaction-import-gpg@v6 uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6.3.0
with: with:
gpg_private_key: ${{ secrets.GH_BOT_PGP_PRIVATE_KEY }} gpg_private_key: ${{ secrets.GH_BOT_PGP_PRIVATE_KEY }}
passphrase: ${{ secrets.GH_BOT_PGP_PASSPHRASE }} passphrase: ${{ secrets.GH_BOT_PGP_PASSPHRASE }}

2
.github/workflows/integ-test-dependency-graph.yml vendored
View File

@ -178,7 +178,7 @@ jobs:
runs-on: "ubuntu-latest" runs-on: "ubuntu-latest"
steps: steps:
- name: Download dependency-graph artifact - name: Download dependency-graph artifact
uses: actions/download-artifact@v4 uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
with: with:
path: downloaded-dependency-graphs path: downloaded-dependency-graphs
pattern: dependency-graph_*dependency-graph-generate-submit-and-upload.json pattern: dependency-graph_*dependency-graph-generate-submit-and-upload.json

2
.github/workflows/update-checksums-file.yml vendored
View File

@ -38,7 +38,7 @@ jobs:
working-directory: sources working-directory: sources
- name: Import GPG key to sign commits - name: Import GPG key to sign commits
uses: crazy-max/ghaction-import-gpg@v6 uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6.3.0
with: with:
gpg_private_key: ${{ secrets.GH_BOT_PGP_PRIVATE_KEY }} gpg_private_key: ${{ secrets.GH_BOT_PGP_PRIVATE_KEY }}
passphrase: ${{ secrets.GH_BOT_PGP_PASSPHRASE }} passphrase: ${{ secrets.GH_BOT_PGP_PASSPHRASE }}