From 0600b8c85fe1123199cf918b74664a298276d5a6 Mon Sep 17 00:00:00 2001 From: franchukkk <223016348+enot3615@users.noreply.github.com> Date: Thu, 27 Aug 2026 14:51:27 -0700 Subject: [PATCH] ci: pin every action to a commit SHA, and add the config that keeps them fresh MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit v1.3 blockchain security audit, P1 (pin GitHub Actions to SHAs). All 14 `uses:` references named mutable tags. A tag is a pointer its owner can move, and whatever it points at runs inside CI. This repository publishes the client that every integrating agent installs, which makes its build the most valuable thing in the system to tamper with — worth pinning even though the workflow holds no publish secrets today, because that is a property of the current file and not a guarantee about the next one. Pinned to the SHAs each tag resolved to on 2026-08-27, tag kept as a trailing comment. .github/dependabot.yml ships in the same commit deliberately. A pin with nothing to move it trades "an action can change under us" for "an action can never be patched", and the second failure is silent. The `# v4` comment is what Dependabot reads to know which tag a pin tracks; remove it and updates stop. Based on main rather than dev, against the usual dev-first order: dev and main have diverged (main +3, dev +2) and the reconciliation in #43 is still open, so merging into dev right now would add to that rather than resolve it. #44 is on main for the same reason. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01We1vVZLdj2vYtYaj7fjahX --- .github/dependabot.yml | 27 +++++++++++++++++++++++++++ .github/workflows/ci.yml | 28 ++++++++++++++-------------- 2 files changed, 41 insertions(+), 14 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..8cb224d --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,27 @@ +# Pinning every action to a commit SHA closes the supply-chain hole that a +# mutable tag leaves open: `@v4` is a pointer its owner can move, and whatever +# it points at runs inside CI with whatever that job can reach. +# +# But a pin with nothing to move it is its own defect. It trades "an action can +# change under us" for "an action can never be patched", and the second failure +# is silent — no alert fires for a security release we simply never took. So +# the pin and this file ship together; neither is complete alone. +# +# The `# v4` comment beside each SHA is not decoration. Dependabot reads it to +# know which tag the pin tracks, and rewrites both the SHA and the comment when +# that tag moves. Delete the comment and the pin stops being updated. +# +# Scope is deliberately github-actions only. Adding npm and pip here would open +# a large number of pull requests across three repositories at once, which is a +# separate decision about review capacity rather than about supply chain. +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + commit-message: + prefix: "ci" + labels: + - dependencies + - github-actions diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a035aa7..67abf91 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,12 +20,12 @@ jobs: name: version bumped when published files change runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: # Need history back to the merge base to compare versions. fetch-depth: 0 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 20 @@ -41,9 +41,9 @@ jobs: run: working-directory: node steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 20 cache: npm @@ -74,8 +74,8 @@ jobs: run: working-directory: wallet steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 20 cache: npm @@ -100,9 +100,9 @@ jobs: run: working-directory: mcp steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 20 cache: npm @@ -143,8 +143,8 @@ jobs: name: mcp — built against the agent in this commit runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 20 @@ -172,9 +172,9 @@ jobs: run: working-directory: python steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - - uses: actions/setup-python@v5 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: '3.13' cache: pip @@ -190,9 +190,9 @@ jobs: name: examples — syntax gate runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 20