Skip to content

chore(ci): SHA-pin third-party GitHub Actions - #57

Merged
abbaseya merged 1 commit into
mainfrom
chore/supply-chain-pin-actions
Jul 31, 2026
Merged

chore(ci): SHA-pin third-party GitHub Actions#57
abbaseya merged 1 commit into
mainfrom
chore/supply-chain-pin-actions

Conversation

@abbaseya

@abbaseya abbaseya commented Jul 24, 2026

Copy link
Copy Markdown
Collaborator

What

Supply-chain hardening (Asana 1216667157595351): SHA-pin every third-party GitHub Action on a mutable tag/branch to a current-major commit SHA (no version bumps).

Notably: Pins pypa/gh-action-pypi-publish@release/v1 — previously a moving branch — the PyPI publish step.

Why

A mutable tag/branch can be silently repointed at attacker code that runs in our workflows with our secrets — the tj-actions/changed-files (CVE-2025-30066) attack class. Pinning to an immutable SHA closes it. No behavior change — each ref is pinned to the commit its current major tag already points to. First-party actions/* are deferred to a later pass.

🤖 Generated with Claude Code

Ahmed Abbas @claude
chore(ci): SHA-pin third-party GitHub Actions
8a9c3af 
Supply-chain hardening (Asana 1216667157595351): pin every third-party
GitHub Action on a mutable tag/branch to a current-major commit SHA (no
version bumps) — the tj-actions/changed-files (CVE-2025-30066) attack class.
First-party actions/* are deferred to a later pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
@gemini-code-assist

gemini-code-assist Bot commented Jul 24, 2026

Copy link
Copy Markdown

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

@abbaseya abbaseya self-assigned this Jul 24, 2026
@abbaseya
abbaseya requested a review from usmanabbas7 July 24, 2026 16:35
@usmanabbas7

usmanabbas7 commented Jul 31, 2026

Copy link
Copy Markdown
Collaborator

LGTM — pins verified against upstream, coverage is complete.

Ref Verified
astral-sh/setup-uv@v5 annotated tag v5 dereferences to exactly d4b2f3b6…fcb86 (= v5.4.2) ✅
pypa/gh-action-pypi-publish ba38be9e…a247 is v1.14.1 — a real release tag, and was release/v1 HEAD from 2026-05-21 until 2026-07-28, so it was HEAD when this PR was opened ✅

All 6 setup-uv refs (5 in ci.yml, 1 in release.yml) + the pypa ref are pinned; only first-party actions/* remain, as stated.

One non-obvious thing I checked

pypa/gh-action-pypi-publish is a composite action that generates a Docker action at runtime — create-docker-action.py builds the image as docker://ghcr.io/{repo}:{ref} from github.action_ref. So this PR silently changes the pulled image tag from release-v1 to the 40-char SHA. That's worth checking because release.yml is never exercised by CI — all 27 green checks come from ci.yml, and the publish step would first run at an actual release.

Verified it's safe: ghcr.io/pypa/gh-action-pypi-publish:ba38be9e461d3875417946c167d0b5f3d385a247 returns HTTP 200, and pypa's build-and-push-docker-image.yml:71 (docker tag $IMAGE $IMAGE_SHA) publishes SHA-tagged images systematically. Upstream's README endorses this path directly: "opt-in to use a full Git commit SHA and Dependabot."

Two follow-ups (non-blocking)

  1. No updater in the repo — no dependabot.yml / renovate.json. Upstream pairs the SHA-pin recommendation with Dependabot for good reason: setup-uv is now pinned to v5.4.2 (Apr 2025) while latest is v9.0.0 (2026-07-21), four majors behind. Pre-existing staleness, correctly out of scope here, but a hard SHA makes it permanent and invisible. Suggest a follow-up adding the github-actions ecosystem to Dependabot.

  2. Collision with feat/python-sdk-serving-config-codegen — that branch adds a changelog job to ci.yml with a 7th, unpinned astral-sh/setup-uv@v5 (line 152). Whichever merges second needs reconciling, or the hardening silently regresses.

Nit: # v5 → # v5.4.2. Dependabot reads the trailing comment to determine the current version, and the precise tag tells a reader how stale the pin actually is.

The "no behavior change" claim holds exactly, by the way — the v5 tag hasn't moved since 2025-04-16, so it was already de-facto frozen.

@abbaseya
abbaseya merged commit 12668bd into main Jul 31, 2026
27 checks passed
@abbaseya
abbaseya deleted the chore/supply-chain-pin-actions branch July 31, 2026 14:12
@usmanabbas7 usmanabbas7 mentioned this pull request Jul 31, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@usmanabbas7 usmanabbas7 usmanabbas7 approved these changes

Assignees

See More

@abbaseya abbaseya

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@abbaseya @usmanabbas7