ci: pin third-party GitHub Actions to commit SHA in IO_Iceberg_Unit_Tests.yml - #39917
Open
2akouwu wants to merge 1 commit into
Open
ci: pin third-party GitHub Actions to commit SHA in IO_Iceberg_Unit_Tests.yml#399172akouwu wants to merge 1 commit into
2akouwu wants to merge 1 commit into
Conversation
…ests.yml Pins actions/checkout, actions/upload-artifact (both usages), EnricoMi/publish-unit-test-result-action, and jwgmeligmeyling/spotbugs-github-action to their exact current commit SHA instead of a mutable version tag, keeping the version as a trailing comment for readability. A tag can be moved to point at different code after the fact (by the action's own maintainer, or if their account/repo is compromised), so a workflow pinned only to a tag can silently start running different code than what was reviewed when the workflow was written. Pinning to a full commit SHA is the mitigation recommended by GitHub's Actions security hardening guide and OpenSSF Scorecard's Pinned-Dependencies check. Only this one workflow file is touched; local composite actions under ./.github/actions/... are unaffected since they are not external and do not carry this risk.
Contributor
|
Assigning reviewers: R: @Abacn for label build. Note: If you would like to opt out of this review, comment Available commands:
The PR bot will only process comments in the main thread (not review comments). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Pins the third-party GitHub Actions used in
IO_Iceberg_Unit_Tests.ymlto their exact commit SHA instead of a mutable version tag:actions/checkout@v7→@3d3c42e...(# v7)actions/upload-artifact@v7(both usages) →@043fb46...(# v7)EnricoMi/publish-unit-test-result-action@v2→@d0a4676...(# v2)jwgmeligmeyling/spotbugs-github-action@v1.2→@b8e2c35...(# v1.2)Why
A tag like
@v7can be moved to point at different code after the fact (by the action's own maintainer, or if their account/repo is compromised), so a workflow pinned only to a tag can silently start running different code than what was reviewed when the workflow was written. Pinning to a full commit SHA (keeping the version as a trailing comment for readability) is the mitigation GitHub's own Actions security hardening guide and OpenSSF Scorecard'sPinned-Dependenciescheck both recommend.This only touches the one workflow file that had unpinned references; the local composite actions under
./.github/actions/...are untouched since they aren't external and don't carry this risk.Testing
This is a CI-workflow-only change with no code path to unit test. I verified each SHA by resolving the exact commit each tag currently points to via the GitHub API (
git/refs/tags/..., dereferencing the annotated tag object forEnricoMi/publish-unit-test-result-action), and confirmed the file is still valid YAML. The real verification is that the workflow keeps running identically on its next trigger, since each SHA is exactly the commit its tag currently resolves to.