Conversation
There was a problem hiding this comment.
Pull request overview
This PR aims to improve supply-chain security by pinning GitHub Actions used in CI workflows to specific commit SHAs instead of floating version tags. This prevents malicious actors from compromising workflows by modifying tags on upstream repositories.
Changes:
- Pin
docker/setup-buildx-actionin on-tag.yml workflow to a specific commit SHA with version reference - Pin
vmactions/freebsd-vmin ci.yml workflow to a specific commit SHA with version reference
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| .github/workflows/on-tag.yml | Pins docker/setup-buildx-action to commit SHA 8d2750c68a42422c14e847fe6c8ac0403b4cbd6f (v3.12.0) |
| .github/workflows/ci.yml | Pins vmactions/freebsd-vm to commit SHA c9f815bc7aa0d34c9fdd0619b034a32d6ca7b57e (v1.4.2) |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
|
||
| - name: Setup Docker buildx action | ||
| uses: docker/setup-buildx-action@v3 | ||
| uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 |
There was a problem hiding this comment.
While this change pins docker/setup-buildx-action to a commit SHA, the PR only partially addresses the goal of pinning all GitHub Actions. Other unpinned actions in this same workflow include actions/checkout@v3 (line 45), docker/setup-qemu-action@v3 (line 48), and actions/cache@v3 (line 59). For complete supply-chain risk mitigation, consider pinning all floating action references in this workflow.
| key: freebsd-${{ env.FREEBSD_VER }}-cargo-checks-${{ hashFiles('**/Cargo.lock') }} | ||
| - name: Compile Checks in FreeBSD | ||
| uses: vmactions/freebsd-vm@v1 | ||
| uses: vmactions/freebsd-vm@c9f815bc7aa0d34c9fdd0619b034a32d6ca7b57e # v1.4.2 |
There was a problem hiding this comment.
While this change pins vmactions/freebsd-vm to a commit SHA, the PR only partially addresses the goal of pinning all GitHub Actions. Other unpinned actions in this same workflow include actions/checkout@v4 (lines 15, 26, 37, 50, 100) and actions/cache@v3 (line 52). For complete supply-chain risk mitigation, consider pinning all floating action references in this workflow.
📝 Summary
Pin GitHub Actions used in CI workflows to full commit SHAs.
This removes floating action references and reduces supply-chain risk by ensuring workflow execution uses reviewed, immutable upstream revisions instead of tags that can be moved.