Pin GitHub Actions to SHA digests (zizmor unpinned-uses)
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
Research direction
Start in .github/workflows/ and run the provided pin-github-action command against the workflow files. Check the resulting references and rerun zizmor's unpinned-uses audit; done means all 25 findings are resolved with full commit SHAs.
Written by the indexing model from the issue text.
Description
Pin GitHub Actions to SHA digests
Zizmor detected 25 unpinned-uses findings in .github/workflows/.
GitHub Actions referenced by tag (e.g. actions/checkout@v4) are vulnerable to tag mutation — a compromised or hijacked tag can introduce malicious code into CI runs. Pinning to a full commit SHA (e.g. actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4) eliminates this supply-chain risk.
Fix
Run pin-github-action to update all workflow files automatically:
npx pin-github-action .github/workflows/*.yml
Recommendations
- Dependabot: Add a
.github/dependabot.ymlwith agithub-actionsentry so pinned SHAs are updated automatically when new Action versions are released. - zizmor-action: Add zizmor-action for continuous workflow security scanning in CI.
References
Opened by ds-security-scanning zizmor-cli-unpinned-uses
- Dominant language
- TypeScript
- Stars
- 45
- Forks
- 17
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from NASA-IMPACT/veda-ui
-
Difficulty 2/5 1-3 hours Newbie friendliness 67/100
NASA-IMPACT/veda-ui#1986 · 1 comment · 1 reaction ·
-
Difficulty 5/5 Over a week Newbie friendliness 15/100
NASA-IMPACT/veda-ui#1970 ·
-
NASA-IMPACT/veda-ui#1963 · 1 assignee ·
-
[v7] Type imports using full path file reference and no .d extension causes parcel build failure Opentech debt
Difficulty 3/5 1-2 days Newbie friendliness 45/100
NASA-IMPACT/veda-ui#1953 · 1 reaction ·
-
epic
Difficulty 5/5 Over a week Newbie friendliness 20/100
NASA-IMPACT/veda-ui#1920 ·
All issues in NASA-IMPACT/veda-ui
Similar issues
-
calcite-components needs triage refactor
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Esri/calcite-design-system#15203 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 91/100
-
community first-timers-only good first issue hacktoberfest help wanted low hanging fruit up-for-grabs
Difficulty 1/5 Under an hour Newbie friendliness 95/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Automattic/studio#4908 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100