From f1e8d059dbc8ade8895e5fa03a4d5f11caa79c64 Mon Sep 17 00:00:00 2001 From: Rich Megginson Date: Wed, 12 Aug 2026 17:03:49 -0600 Subject: [PATCH] ci: use commit hash for github action, add persist-credentials false [citest_skip] The latest security guidance is to use the full commit hash, which is immutable, instead of a tag or version, which can be mutable, for the reference to a version of a github action. There are known attacks which inserted unauthorized code in a version tag and moved the tag. This prevents this sort of attack, at the cost of more maintenance burden, but dependabot will largely take care of this for us. Each version or tag has been replaced with the corresponding commit hash - in some cases, this is not the latest commit on the main branch, so I would expect to see some dependabot updates in the near future. I thought it was safer to do it this way - preserve existing behavior/functionality - rather than replace and upgrade to a newer version at the same time. The coderabbit `Pin the Galaxy action's container image.` issue is tracked at https://github.com/robertdebock/galaxy-action/issues/16 This also adds `persist-credentials: false` to the actions/checkout tasks so that any credentials used by that task will not persist for subsequent tasks, for those workflows that do not need the credentials for subsequent tasks. Signed-off-by: Rich Megginson --- .github/workflows/ansible-lint.yml | 8 +++++--- .github/workflows/ansible-managed-var-comment.yml | 6 ++++-- .github/workflows/ansible-test.yml | 8 +++++--- .github/workflows/build_docs.yml | 6 +++--- .github/workflows/changelog_to_tag.yml | 10 ++++++---- .github/workflows/codeql.yml | 10 ++++++---- .github/workflows/codespell.yml | 6 ++++-- .github/workflows/markdownlint.yml | 4 +++- .github/workflows/pr-title-lint.yml | 3 ++- .github/workflows/python-unit-test.yml | 10 ++++++---- .github/workflows/qemu-kvm-integration-tests.yml | 12 +++++++----- .github/workflows/test_converting_readme.yml | 6 ++++-- .github/workflows/tft.yml | 15 +++++++++------ .github/workflows/weekly_ci.yml | 5 +++-- .github/workflows/woke.yml | 6 ++++-- 15 files changed, 71 insertions(+), 44 deletions(-) diff --git a/.github/workflows/ansible-lint.yml b/.github/workflows/ansible-lint.yml index 01e8824e..8f95150d 100644 --- a/.github/workflows/ansible-lint.yml +++ b/.github/workflows/ansible-lint.yml @@ -39,15 +39,17 @@ jobs: sudo apt install -y git - name: Checkout repo - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Install tox, tox-lsr run: | set -euxo pipefail - pip3 install "git+https://github.com/linux-system-roles/tox-lsr@3.20.1" + pip3 install "git+https://github.com/linux-system-roles/tox-lsr@d594be24ed56e586a5796720d51c261e40c20496" - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: python-version: ${{ matrix.versions.python }} diff --git a/.github/workflows/ansible-managed-var-comment.yml b/.github/workflows/ansible-managed-var-comment.yml index a2127cdb..0a359d07 100644 --- a/.github/workflows/ansible-managed-var-comment.yml +++ b/.github/workflows/ansible-managed-var-comment.yml @@ -28,12 +28,14 @@ jobs: sudo apt install -y git - name: Checkout repo - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Install tox, tox-lsr run: | set -euxo pipefail - pip3 install "git+https://github.com/linux-system-roles/tox-lsr@3.20.1" + pip3 install "git+https://github.com/linux-system-roles/tox-lsr@d594be24ed56e586a5796720d51c261e40c20496" - name: Run ansible-plugin-scan run: | diff --git a/.github/workflows/ansible-test.yml b/.github/workflows/ansible-test.yml index 033d7e96..815e8987 100644 --- a/.github/workflows/ansible-test.yml +++ b/.github/workflows/ansible-test.yml @@ -42,15 +42,17 @@ jobs: sudo apt install -y git - name: Checkout repo - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Install tox, tox-lsr run: | set -euxo pipefail - pip3 install "git+https://github.com/linux-system-roles/tox-lsr@3.20.1" + pip3 install "git+https://github.com/linux-system-roles/tox-lsr@d594be24ed56e586a5796720d51c261e40c20496" - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: python-version: ${{ matrix.versions.python }} diff --git a/.github/workflows/build_docs.yml b/.github/workflows/build_docs.yml index eac3504b..6bf54036 100644 --- a/.github/workflows/build_docs.yml +++ b/.github/workflows/build_docs.yml @@ -25,7 +25,7 @@ jobs: sudo apt install -y git - name: Check out code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: fetch-depth: 0 - name: Ensure the docs branch @@ -48,12 +48,12 @@ jobs: fi - name: Checkout the docs branch - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: ref: docs - name: Fetch README.md and .pandoc_template.html5 template from the workflow branch - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: sparse-checkout: | README.md diff --git a/.github/workflows/changelog_to_tag.yml b/.github/workflows/changelog_to_tag.yml index 7918402e..7585dea7 100644 --- a/.github/workflows/changelog_to_tag.yml +++ b/.github/workflows/changelog_to_tag.yml @@ -22,7 +22,9 @@ jobs: sudo apt install -y git - name: checkout PR - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Get tag and message from the latest CHANGELOG.md commit id: tag @@ -69,7 +71,7 @@ jobs: echo "tagname=$_tagname" >> "$GITHUB_OUTPUT" echo "branch=$_branch" >> "$GITHUB_OUTPUT" - name: Create tag - uses: mathieudutour/github-tag-action@v6.2 + uses: mathieudutour/github-tag-action@a22cf08638b34d5badda920f9daf6e72c477b07b # v6.2 with: github_token: ${{ secrets.GITHUB_TOKEN }} custom_tag: ${{ steps.tag.outputs.tagname }} @@ -77,7 +79,7 @@ jobs: - name: Create Release id: create_release - uses: ncipollo/release-action@v1 + uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1 with: tag: ${{ steps.tag.outputs.tagname }} name: Version ${{ steps.tag.outputs.tagname }} @@ -85,7 +87,7 @@ jobs: makeLatest: true - name: Publish role to Galaxy - uses: robertdebock/galaxy-action@1.2.1 + uses: robertdebock/galaxy-action@7d89099e09f4385ec4b53eb58c0d120f1ad806dd # 1.2.1 with: galaxy_api_key: ${{ secrets.galaxy_api_key }} git_branch: ${{ steps.tag.outputs.branch }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 6543e26b..714e05fa 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -34,18 +34,20 @@ jobs: sudo apt update sudo apt install -y git - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@v4.37.4 + uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 with: languages: ${{ matrix.language }} queries: +security-and-quality - name: Autobuild - uses: github/codeql-action/autobuild@v4.37.4 + uses: github/codeql-action/autobuild@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.37.4 + uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml index 45c19134..c389f2a2 100644 --- a/.github/workflows/codespell.yml +++ b/.github/workflows/codespell.yml @@ -13,7 +13,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Codespell - uses: codespell-project/actions-codespell@v2 + uses: codespell-project/actions-codespell@406322ec52dd7b488e48c1c4b82e2a8b3a1bf630 # v2 diff --git a/.github/workflows/markdownlint.yml b/.github/workflows/markdownlint.yml index 89560149..bc2ff07f 100644 --- a/.github/workflows/markdownlint.yml +++ b/.github/workflows/markdownlint.yml @@ -28,7 +28,9 @@ jobs: sudo apt install -y git - name: Check out code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false # CHANGELOG.md is generated automatically from PR titles and descriptions # It might have issues but they are not critical diff --git a/.github/workflows/pr-title-lint.yml b/.github/workflows/pr-title-lint.yml index a1eeabca..d504e1c2 100644 --- a/.github/workflows/pr-title-lint.yml +++ b/.github/workflows/pr-title-lint.yml @@ -18,8 +18,9 @@ jobs: commit-checks: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: + persist-credentials: false fetch-depth: 0 - name: Install pr_title_lint.py diff --git a/.github/workflows/python-unit-test.yml b/.github/workflows/python-unit-test.yml index bc0859ab..e461fa4a 100644 --- a/.github/workflows/python-unit-test.yml +++ b/.github/workflows/python-unit-test.yml @@ -43,7 +43,9 @@ jobs: sudo apt install -y git - name: checkout PR - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Set up Python 2.7 if: ${{ matrix.pyver_os.ver == '2.7' }} @@ -53,7 +55,7 @@ jobs: - name: Set up Python 3 if: ${{ matrix.pyver_os.ver != '2.7' }} - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: python-version: ${{ matrix.pyver_os.ver }} @@ -70,7 +72,7 @@ jobs: tox=tox virtualenv=virtualenv fi - pip install "$tox" "$virtualenv" "git+https://github.com/linux-system-roles/tox-lsr@3.20.1" + pip install "$tox" "$virtualenv" "git+https://github.com/linux-system-roles/tox-lsr@d594be24ed56e586a5796720d51c261e40c20496" # If you have additional OS dependency packages e.g. libcairo2-dev # then put them in .github/config/ubuntu-requirements.txt, one # package per line. @@ -92,4 +94,4 @@ jobs: TOXENV="$toxenvs" lsr_ci_runtox - name: Upload coverage reports to Codecov - uses: codecov/codecov-action@v7 + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7 diff --git a/.github/workflows/qemu-kvm-integration-tests.yml b/.github/workflows/qemu-kvm-integration-tests.yml index 318b7e4b..b2371f99 100644 --- a/.github/workflows/qemu-kvm-integration-tests.yml +++ b/.github/workflows/qemu-kvm-integration-tests.yml @@ -52,7 +52,9 @@ jobs: steps: - name: Checkout repo - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Check if platform is supported id: check_platform @@ -111,7 +113,7 @@ jobs: python3 -m pip install --upgrade pip sudo apt update sudo apt install -y --no-install-recommends git ansible-core genisoimage qemu-system-x86 - pip3 install "git+https://github.com/linux-system-roles/tox-lsr@3.20.1" + pip3 install "git+https://github.com/linux-system-roles/tox-lsr@d594be24ed56e586a5796720d51c261e40c20496" - name: Check for podman version 5 or higher id: check_podman_version @@ -128,7 +130,7 @@ jobs: - name: Ensure use of podman 5 if: steps.check_platform.outputs.supported && steps.check_podman_version.outputs.need_podman_update == 1 - uses: redhat-actions/podman-install@main + uses: redhat-actions/podman-install@3b6c60c447c93960c0b76faa0c66c6694bc71350 # main - name: Configure tox-lsr if: steps.check_platform.outputs.supported @@ -212,7 +214,7 @@ jobs: - name: Upload test logs on failure if: failure() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: "logs-${{ matrix.scenario.image }}-${{ matrix.scenario.env }}" path: | @@ -238,7 +240,7 @@ jobs: - name: Set commit status as success with a description that platform is skipped if: ${{ steps.check_platform.outputs.supported == '' }} - uses: myrotvorets/set-commit-status-action@master + uses: myrotvorets/set-commit-status-action@2774e1f040c82ed70a76b4b5cd53bb11ffaedd0a # master with: status: success context: "${{ github.workflow }} / scenario (${{ matrix.scenario.image }}, ${{ matrix.scenario.env }}) (pull_request)" diff --git a/.github/workflows/test_converting_readme.yml b/.github/workflows/test_converting_readme.yml index 696275f8..bce11fba 100644 --- a/.github/workflows/test_converting_readme.yml +++ b/.github/workflows/test_converting_readme.yml @@ -29,7 +29,9 @@ jobs: sudo apt install -y git - name: Check out code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Remove badges from README.md prior to converting to HTML run: sed -i '1,8 {/^\[\!.*actions\/workflows/d}' README.md @@ -43,7 +45,7 @@ jobs: --output README.html README.md - name: Upload README.html as an artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: README.html path: README.html diff --git a/.github/workflows/tft.yml b/.github/workflows/tft.yml index 1a2a9c7a..8925d5b6 100644 --- a/.github/workflows/tft.yml +++ b/.github/workflows/tft.yml @@ -36,7 +36,9 @@ jobs: GITHUB_CONTEXT: ${{ toJson(github) }} - name: Checkout repo - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Get head sha of the PR id: head_sha @@ -49,8 +51,9 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Checkout PR - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: + persist-credentials: false ref: ${{ steps.head_sha.outputs.head_sha }} - name: Get memory @@ -136,7 +139,7 @@ jobs: - name: Set commit status as pending if: contains(needs.prepare_vars.outputs.supported_platforms, matrix.platform) - uses: myrotvorets/set-commit-status-action@master + uses: myrotvorets/set-commit-status-action@2774e1f040c82ed70a76b4b5cd53bb11ffaedd0a # master with: sha: ${{ needs.prepare_vars.outputs.head_sha }} status: pending @@ -146,7 +149,7 @@ jobs: - name: Set commit status as success with a description that platform is skipped if: "!contains(needs.prepare_vars.outputs.supported_platforms, matrix.platform)" - uses: myrotvorets/set-commit-status-action@master + uses: myrotvorets/set-commit-status-action@2774e1f040c82ed70a76b4b5cd53bb11ffaedd0a # master with: sha: ${{ needs.prepare_vars.outputs.head_sha }} status: success @@ -155,7 +158,7 @@ jobs: targetUrl: "" - name: Run test in testing farm - uses: sclorg/testing-farm-as-github-action@v4 + uses: sclorg/testing-farm-as-github-action@230555baceb860aa468d216f1822974836b965d1 # v4 if: contains(needs.prepare_vars.outputs.supported_platforms, matrix.platform) with: git_ref: main @@ -184,7 +187,7 @@ jobs: tmt_plan_filter: "tag:playbooks_parallel,bootloader" - name: Set final commit status - uses: myrotvorets/set-commit-status-action@master + uses: myrotvorets/set-commit-status-action@2774e1f040c82ed70a76b4b5cd53bb11ffaedd0a # master if: always() && contains(needs.prepare_vars.outputs.supported_platforms, matrix.platform) with: sha: ${{ needs.prepare_vars.outputs.head_sha }} diff --git a/.github/workflows/weekly_ci.yml b/.github/workflows/weekly_ci.yml index 758ad936..d46bd95b 100644 --- a/.github/workflows/weekly_ci.yml +++ b/.github/workflows/weekly_ci.yml @@ -30,8 +30,9 @@ jobs: sudo apt install -y git - name: Checkout latest code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: + persist-credentials: true # needed for commit and push fetch-depth: 0 - name: Create or rebase commit, add dump_packages callback run: | @@ -50,7 +51,7 @@ jobs: git push -f --set-upstream origin ${{ env.BRANCH_NAME }} - name: Create and comment pull request - uses: actions/github-script@v9 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 with: github-token: ${{ secrets.GH_PUSH_TOKEN }} script: | diff --git a/.github/workflows/woke.yml b/.github/workflows/woke.yml index 7f34776c..ab44dcea 100644 --- a/.github/workflows/woke.yml +++ b/.github/workflows/woke.yml @@ -11,11 +11,13 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Run lsr-woke-action # Originally, uses: get-woke/woke-action@v0 - uses: linux-system-roles/lsr-woke-action@main + uses: linux-system-roles/lsr-woke-action@33e72e28c826f05aaee08d0b70c7d2cd9e0a39a7 # main with: woke-args: "-c https://raw.githubusercontent.com/linux-system-roles/tox-lsr/main/src/tox_lsr/config_files/woke.yml --count-only-error-for-failure" # Cause the check to fail on any broke rules