Repository navigation
Security: pin GitHub Actions to SHA hashes - #237
Conversation
Up to standards ✅
|
Replaces mutable tag/branch references with immutable SHA hashes to prevent supply chain attacks (ref: TeamPCP/Trivy March 2026). Actions left as tags: 0
f301426 to
517fb2f
Compare
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
While this PR correctly implements the security practice of pinning GitHub Actions to SHA hashes, there are critical issues that must be addressed before merging.
First, a high-severity security risk was identified in the auto-merge.yml workflow, where pull_request_target is used alongside a checkout of untrusted code. Second, the SHA pinned for actions/github-script in comment_issue.yml does not match the official release tag, which defeats the purpose of the security hardening. Finally, several actions use deprecated Node.js 12 runtimes that should be upgraded to maintain workflow stability.
About this PR
- There are no automated tests or verification scripts provided to validate that the commit SHAs correspond correctly to the intended version tags. Incorrect SHAs can lead to workflow failures or the execution of unverified code.
Test suggestions
- Verify that all GitHub Action steps in .github/workflows use commit SHAs instead of tags
- Validate that the pinned SHAs correspond correctly to the version tags mentioned in comments
- Verify that CI/CD workflows (auto-merge, issue creation/commenting) trigger and execute successfully with the new SHAs
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify that all GitHub Action steps in .github/workflows use commit SHAs instead of tags
2. Validate that the pinned SHAs correspond correctly to the version tags mentioned in comments
3. Verify that CI/CD workflows (auto-merge, issue creation/commenting) trigger and execute successfully with the new SHAs
🗒️ Improve review quality by adding custom instructions
| if: github.actor == 'dependabot[bot]' | ||
| steps: | ||
| - uses: actions/checkout@v2 | ||
| - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 |
There was a problem hiding this comment.
🔴 HIGH RISK
Using pull_request_target while checking out the head branch of a pull request is a security risk as it grants untrusted code access to repository secrets. Furthermore, actions/checkout@v2 is deprecated (Node.js 12). It is recommended to upgrade to v4 and verify if the checkout step is strictly necessary for the auto-merge action to function.
| - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 | |
| - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 |
| if: env.JIRA_CREATE_COMMENT_AUTO == 'true' | ||
| id: github_issue_type | ||
| uses: actions/github-script@v2.0.0 | ||
| uses: actions/github-script@6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 # v2.0.0 |
There was a problem hiding this comment.
🟡 MEDIUM RISK
The SHA 6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 does not match the official v2.0.0 release tag (d125163f350c609fc22a912a20839e93b169b165). Additionally, actions/github-script@v2 is deprecated. Consider upgrading to v7 to ensure a supported runtime, though this will require minor script syntax updates (e.g., using github.rest.issues).
Pins all GitHub Actions from mutable tags/branches to immutable SHA hashes.
This prevents supply chain attacks like the TeamPCP/Trivy incident (March 2026), where attackers force-pushed tags to point at malicious commits.
Auto-generated by the Codacy security audit script.