ci: pin workflow actions to commit SHAs (audit MD-28) - #81
Conversation
The fork's CI and Docker-publish chain (which holds packages:write) referenced actions by mutable major tags, so a compromised upstream release could hijack the pipeline. Every external action used by the fork's own chain (deploy-docker, deploy-api-v2-docker, check-types, lint, unit-tests and the yarn-install/cache-checkout composite actions) is now pinned to the latest in-major release SHA with the version kept in a trailing comment. No major-version jumps.
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request pins GitHub Actions to specific commit SHAs in the cache-checkout and yarn-install composite actions. However, the reviewer identified several critical issues: a 46-character invalid commit SHA was used across multiple cache actions, an invalid SHA was used for the setup-node action, and several referenced action versions do not exist or are mismatched. It is recommended to update these to valid 40-character SHAs and correct version tags to prevent workflow failures.
| steps: | ||
| - name: Cache git checkout | ||
| uses: actions/cache@v4 | ||
| uses: actions/cache@0057852bfaa89a56745cba8642d1e84afbd3f7d6820020 # v4.3.0 |
There was a problem hiding this comment.
The commit SHA 0057852bfaa89a56745cba8642d1e84afbd3f7d6820020 is 46 characters long, which is syntactically invalid for a Git commit SHA (must be exactly 40 characters). This will cause the GitHub Actions workflow to fail to resolve the action. Additionally, actions/cache does not have a v4.3.0 release (the latest is v4.2.2). Please use a valid 40-character commit SHA corresponding to an actual release, such as d930a002631305090c8b0166dd7b71dce4d21261 for v4.2.0.
uses: actions/cache@d930a002631305090c8b0166dd7b71dce4d21261 # v4.2.0| - name: Check yarn cache (lookup-only) | ||
| if: ${{ inputs.skip-install-if-cache-hit == 'true' }} | ||
| uses: actions/cache/restore@v4 | ||
| uses: actions/cache/restore@0057852bfaa89a56745cba8642d1e84afbd3f7d6820020 # v4.3.0 |
There was a problem hiding this comment.
The commit SHA 0057852bfaa89a56745cba8642d1e84afbd3f7d6820020 is 46 characters long, which is syntactically invalid for a Git commit SHA. This will cause the workflow to fail. Please use a valid 40-character commit SHA corresponding to an actual release of actions/cache/restore, such as d930a002631305090c8b0166dd7b71dce4d21261 for v4.2.0.
uses: actions/cache/restore@d930a002631305090c8b0166dd7b71dce4d21261 # v4.2.0| - name: Check node_modules cache (lookup-only) | ||
| if: ${{ inputs.skip-install-if-cache-hit == 'true' }} | ||
| uses: actions/cache/restore@v4 | ||
| uses: actions/cache/restore@0057852bfaa89a56745cba8642d1e84afbd3f7d6820020 # v4.3.0 |
There was a problem hiding this comment.
The commit SHA 0057852bfaa89a56745cba8642d1e84afbd3f7d6820020 is 46 characters long, which is syntactically invalid. Please use a valid 40-character commit SHA corresponding to an actual release of actions/cache/restore, such as d930a002631305090c8b0166dd7b71dce4d21261 for v4.2.0.
uses: actions/cache/restore@d930a002631305090c8b0166dd7b71dce4d21261 # v4.2.0| - name: Check yarn install state cache (lookup-only) | ||
| if: ${{ inputs.skip-install-if-cache-hit == 'true' }} | ||
| uses: actions/cache/restore@v4 | ||
| uses: actions/cache/restore@0057852bfaa89a56745cba8642d1e84afbd3f7d6820020 # v4.3.0 |
There was a problem hiding this comment.
The commit SHA 0057852bfaa89a56745cba8642d1e84afbd3f7d6820020 is 46 characters long, which is syntactically invalid. Please use a valid 40-character commit SHA corresponding to an actual release of actions/cache/restore, such as d930a002631305090c8b0166dd7b71dce4d21261 for v4.2.0.
uses: actions/cache/restore@d930a002631305090c8b0166dd7b71dce4d21261 # v4.2.0| - name: Restore yarn cache | ||
| if: ${{ inputs.skip-install-if-cache-hit != 'true' || steps.all-caches-check.outputs.all-hit != 'true' }} | ||
| uses: actions/cache@v4 | ||
| uses: actions/cache@0057852bfaa89a56745cba8642d1e84afbd3f7d6820020 # v4.3.0 |
There was a problem hiding this comment.
The commit SHA 0057852bfaa89a56745cba8642d1e84afbd3f7d6820020 is 46 characters long, which is syntactically invalid. Please use a valid 40-character commit SHA corresponding to an actual release of actions/cache, such as d930a002631305090c8b0166dd7b71dce4d21261 for v4.2.0.
uses: actions/cache@d930a002631305090c8b0166dd7b71dce4d21261 # v4.2.0| if: ${{ inputs.skip-install-if-cache-hit != 'true' || steps.all-caches-check.outputs.all-hit != 'true' }} | ||
| id: yarn-nm-cache | ||
| uses: actions/cache@v4 | ||
| uses: actions/cache@0057852bfaa89a56745cba8642d1e84afbd3f7d6820020 # v4.3.0 |
There was a problem hiding this comment.
The commit SHA 0057852bfaa89a56745cba8642d1e84afbd3f7d6820020 is 46 characters long, which is syntactically invalid. Please use a valid 40-character commit SHA corresponding to an actual release of actions/cache, such as d930a002631305090c8b0166dd7b71dce4d21261 for v4.2.0.
uses: actions/cache@d930a002631305090c8b0166dd7b71dce4d21261 # v4.2.0| if: ${{ inputs.skip-install-if-cache-hit != 'true' || steps.all-caches-check.outputs.all-hit != 'true' }} | ||
| id: yarn-install-state-cache | ||
| uses: actions/cache@v4 | ||
| uses: actions/cache@0057852bfaa89a56745cba8642d1e84afbd3f7d6820020 # v4.3.0 |
There was a problem hiding this comment.
The commit SHA 0057852bfaa89a56745cba8642d1e84afbd3f7d6820020 is 46 characters long, which is syntactically invalid. Please use a valid 40-character commit SHA corresponding to an actual release of actions/cache, such as d930a002631305090c8b0166dd7b71dce4d21261 for v4.2.0.
uses: actions/cache@d930a002631305090c8b0166dd7b71dce4d21261 # v4.2.0| steps: | ||
| - name: Use Node ${{ inputs.node_version }} | ||
| uses: actions/setup-node@v4 | ||
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 |
There was a problem hiding this comment.
The commit SHA 49933ea5288caeca8642d1e84afbd3f7d6820020 is invalid and does not correspond to any release of actions/setup-node. Additionally, v4.4.0 does not exist for actions/setup-node (the latest is v4.2.0). Please use a valid commit SHA, such as 1d71962b49693772fb9c9f966958fc8f86c4cd87 for v4.2.0.
uses: actions/setup-node@1d71962b49693772fb9c9f966958fc8f86c4cd87 # v4.2.0| - name: Checkout PR code (on cache miss) | ||
| if: steps.cache-checkout.outputs.cache-hit != 'true' | ||
| uses: actions/checkout@v4 | ||
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 |
There was a problem hiding this comment.
The comment indicates version v4.4.0, but the commit SHA 11d5960a326750d5838078e36cf38b85af677262 actually corresponds to v4.2.2 (as v4.4.0 does not exist for actions/checkout). Please update the comment to correctly reflect the version as v4.2.2 to avoid confusion.
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
docs(audit): record Round 7 - actions pinned to SHAs (PR #81)
1 participant
What
Every external action used by the fork's own CI/deploy chain is now pinned to the latest in-major release SHA (version kept as a trailing comment):
No major-version jumps (checkout stays v4.x line, build-push stays v6.x, etc.) - SHAs were resolved from the latest release within the major each workflow already used.
Why: mutable tags mean a compromised upstream release could hijack the pipeline that publishes production images (audit MD-28 / HI-12 remainder).
Evidence
uses: @vNentries remain in the touched files.🤖 Generated by ZCode