ci: pin every action to a commit SHA, with the config that keeps them fresh (audit P1) - #45
Open
enot3615 wants to merge 1 commit into
Open
ci: pin every action to a commit SHA, with the config that keeps them fresh (audit P1)#45enot3615 wants to merge 1 commit into
enot3615 wants to merge 1 commit into
Conversation
…hem fresh v1.3 blockchain security audit, P1 (pin GitHub Actions to SHAs). All 14 `uses:` references named mutable tags. A tag is a pointer its owner can move, and whatever it points at runs inside CI. This repository publishes the client that every integrating agent installs, which makes its build the most valuable thing in the system to tamper with — worth pinning even though the workflow holds no publish secrets today, because that is a property of the current file and not a guarantee about the next one. Pinned to the SHAs each tag resolved to on 2026-08-27, tag kept as a trailing comment. .github/dependabot.yml ships in the same commit deliberately. A pin with nothing to move it trades "an action can change under us" for "an action can never be patched", and the second failure is silent. The `# v4` comment is what Dependabot reads to know which tag a pin tracks; remove it and updates stop. Based on main rather than dev, against the usual dev-first order: dev and main have diverged (main +3, dev +2) and the reconciliation in #43 is still open, so merging into dev right now would add to that rather than resolve it. #44 is on main for the same reason. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01We1vVZLdj2vYtYaj7fjahX
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The hole
All 14
uses:references inci.ymlnamed mutable tags —actions/checkout@v4,actions/setup-node@v4,actions/setup-python@v5. A tag is a pointer its owner can move, and whatever it points at runs inside CI.This repository publishes the client every integrating agent installs, which makes its build the most valuable thing in the system to tamper with. The workflow holds no publish secrets today — I checked — but that is a property of the current file, not a guarantee about the next one.
Pinned to the SHAs each tag resolved to on 2026-08-27:
actions/checkout11d5960a326750d5838078e36cf38b85af677262actions/setup-node49933ea5288caeca8642d1e84afbd3f7d6820020actions/setup-pythona26af69be951a213d495a4c3e4e4022e16d87065Why
dependabot.ymlis in the same commitA pin with nothing to move it is its own defect. It trades "an action can change under us" for "an action can never be patched", and the second failure is the quieter one.
The
# v4comment beside each SHA is functional: Dependabot reads it to learn which tag a pin tracks and rewrites both when the tag moves. Delete the comment and updates silently stop.Scope is
github-actionsonly — addingnpm/piphere would open a large number of PRs at once, which is a review-capacity decision, not a supply-chain one.Base branch
Based on
mainrather thandev, against the usual dev-first order.devandmainhave diverged (main +3, dev +2) and the reconciliation in #43 is still open, so merging intodevright now would add to that rather than resolve it. #44 sits onmainfor the same reason. Once #43 lands, dev-first resumes.