From 09d73cf413c08eb8e2df5c836140e8a839f20777 Mon Sep 17 00:00:00 2001 From: "mendral-app[bot]" <233154221+mendral-app[bot]@users.noreply.github.com> Date: Wed, 4 Feb 2026 23:10:59 -0800 Subject: [PATCH] chore: pin all third-party actions to SHA digests Pin third-party GitHub Actions to immutable SHA digests to prevent supply chain attacks via tag force-pushing or branch updates. Actions pinned: - trufflesecurity/trufflehog (was @main, now SHA) - sigstore/cosign-installer@v3.8.1 - docker/setup-buildx-action@v3.12.0 - docker/setup-qemu-action@v3.7.0 - docker/login-action@v3.7.0 - goreleaser/goreleaser-action@v6.4.0 - aquasecurity/trivy-action@0.33.1 - github/codeql-action/upload-sarif@v4.32.1 - golangci/golangci-lint-action@v9.2.0 - docker/setup-compose-action@v1.2.0 Version comments added for maintainability. --- .github/workflows/make.yaml | 22 +++++++++++----------- .github/workflows/release.yaml | 14 +++++++------- .github/workflows/secrets.yaml | 2 +- 3 files changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/workflows/make.yaml b/.github/workflows/make.yaml index f1c225d36..0bce83ccb 100644 --- a/.github/workflows/make.yaml +++ b/.github/workflows/make.yaml @@ -31,9 +31,9 @@ jobs: cache: "npm" - run: "npm i -g npm@11.8.0" - run: "npm ci" - - uses: "docker/setup-qemu-action@v3" - - uses: "docker/setup-buildx-action@v3" - - uses: "sigstore/cosign-installer@v3" + - uses: "docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130" # v3.7.0 + - uses: "docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f" # v3.12.0 + - uses: "sigstore/cosign-installer@053f9b74638557590800a301da1ba82351507e2c" # v3.8.1 - name: Cache Trivy database uses: "actions/cache@v5" with: @@ -42,7 +42,7 @@ jobs: restore-keys: | trivy-db-${{ runner.os }}- - uses: "anchore/sbom-action/download-syft@deef08a0db64bfad603422135db61477b16cef56" # v0.22.1 - - uses: "goreleaser/goreleaser-action@v6" + - uses: "goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a" # v6.4.0 with: distribution: "goreleaser" version: "~> v2" @@ -51,7 +51,7 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Scan Docker image with Trivy if: github.ref == 'refs/heads/main' - uses: "aquasecurity/trivy-action@0.33.1" + uses: "aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8" # 0.33.1 with: image-ref: "ghcr.io/getprobo/probo:latest-amd64" format: "sarif" @@ -63,7 +63,7 @@ jobs: cache-dir: ~/.cache/trivy - name: Scan Docker image with Trivy if: github.ref != 'refs/heads/main' - uses: "aquasecurity/trivy-action@0.33.1" + uses: "aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8" # 0.33.1 with: image-ref: "ghcr.io/getprobo/probo:latest-amd64" format: "table" @@ -74,7 +74,7 @@ jobs: cache-dir: ~/.cache/trivy - name: Upload Trivy scan results to GitHub Security tab if: github.ref == 'refs/heads/main' - uses: github/codeql-action/upload-sarif@v4 + uses: github/codeql-action/upload-sarif@6bc82e05fd0ea64601dd4b465378bbcf57de0314 # v4.32.1 with: sarif_file: "trivy-results.sarif" - uses: anchore/sbom-action@deef08a0db64bfad603422135db61477b16cef56 #v0.22.1 @@ -144,7 +144,7 @@ jobs: with: node-version-file: ".nvmrc" cache: "npm" - - uses: golangci/golangci-lint-action@v9 + - uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0 with: install-only: true - run: "npm i -g npm@11.8.0" @@ -220,9 +220,9 @@ jobs: - run: "npm i -g npm@11.8.0" - run: "sudo apt-get install -y mkcert" - run: "sudo mkcert -install 2>&1 | grep -v 'no Firefox and/or Chrome/Chromium security databases found' || true" - - uses: "docker/setup-qemu-action@v3" - - uses: "docker/setup-buildx-action@v3" - - uses: "docker/setup-compose-action@v1" + - uses: "docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130" # v3.7.0 + - uses: "docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f" # v3.12.0 + - uses: "docker/setup-compose-action@364cc21a5de5b1ee4a7f5f9d3fa374ce0ccde746" # v1.2.0 - run: "npm ci" - run: "make stack-up" - run: "make stack-ps" diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index fe382a387..4ac414ed7 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -44,25 +44,25 @@ jobs: run: npm ci - name: Install Cosign - uses: sigstore/cosign-installer@v3 + uses: sigstore/cosign-installer@053f9b74638557590800a301da1ba82351507e2c # v3.8.1 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0 with: platforms: all - name: Log in to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Run GoReleaser - uses: goreleaser/goreleaser-action@v6 + uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0 with: distribution: goreleaser version: "~> v2" @@ -71,7 +71,7 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Scan Docker image with Trivy - uses: aquasecurity/trivy-action@0.33.1 + uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1 with: image-ref: "ghcr.io/getprobo/probo:${{ github.ref_name }}" format: "sarif" @@ -82,7 +82,7 @@ jobs: severity: "CRITICAL,HIGH" - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v4 + uses: github/codeql-action/upload-sarif@6bc82e05fd0ea64601dd4b465378bbcf57de0314 # v4.32.1 if: always() with: sarif_file: "trivy-results.sarif" diff --git a/.github/workflows/secrets.yaml b/.github/workflows/secrets.yaml index 53681dcdd..4119da879 100644 --- a/.github/workflows/secrets.yaml +++ b/.github/workflows/secrets.yaml @@ -17,6 +17,6 @@ jobs: with: fetch-depth: 0 submodules: recursive - - uses: "trufflesecurity/trufflehog@main" + - uses: "trufflesecurity/trufflehog@b78fbfd8eb982f4802e09a265fb2bc37b3040975" # main with: extra_args: "--results=verified,unknown"