Repository navigation
Pin GitHub Actions to commit SHAs for supply-chain hardening - #45
Merged
Merged
Conversation
compile-check.yaml runs on any pull_request (no branch filter), so an upstream tag/branch getting repointed is a real supply-chain vector. Pin every third-party uses: reference to a full commit SHA, keeping the original tag/branch as a trailing comment. arduino/setup-arduino-cli@v2 is actually a branch, not a tag. Fixes #44
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What's wrong
compile-check.yamlandrelease.yamlreferenced third-party actions by mutable tag, andarduino/setup-arduino-cli@v2is actually a branch namedv2, not a tag.compile-check.yamlruns on anypull_request(no branch filter), so an upstream tag/branch getting repointed is a real supply-chain vector.What this does
Pins all 4 third-party
uses:references to full commit SHAs, keeping the original tag/branch as a trailing comment (Dependabot, added in #42, can now propose bumps).No behavior change — same versions, just pinned.
After merge
Enable
sha_pinning_requiredon the repo's Actions settings.How to verify
Open a PR touching any file to trigger
compile-check.yaml, confirm it passes.Fixes #44