feat(ci): pin third-party GitHub Actions to commit SHAs

Open
#224 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
72/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Quiet
Tech stack
github-actions
Domain
ci-cd, security

Research direction

Start by inventorying every uses: entry in .github/workflows/*.yml, including the write-enabled update_snapshot.yml, and identify each third-party action currently using a tag. Replace those references with full-length commit SHAs while retaining the version in a comment; done means all action references are SHA-pinned and the workflow YAML remains valid.

Written by the indexing model from the issue text.

Description

enhancement needs-triage stale
Problem

.github/workflows/*.yml reference GitHub Actions by tag (e.g. actions/checkout@v6, EndBug/add-and-commit@v10.0.0, googleapis/release-please-action@v5, amannn/action-semantic-pull-request@v6, dependabot/fetch-metadata@v3). Tags are mutable: if a maintainer's account is compromised, or a tag is force-moved, the workflow silently runs different action code on the next run. Some of these workflows have write permissions on the repository (e.g. update_snapshot.yml has contents: write and installs from PR-controlled pnpm-workspace.yaml), so a swapped action can exfiltrate secrets or push malicious commits.

Proposed solution

Pin all third-party GitHub Actions to full-length commit SHAs. Dependabot's github-actions updater already supports SHA pinning and will keep them current with monthly PRs. Keep the tag reference in a comment for readability. Example:

- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v6.0.0

First-party actions/* are lower risk (GitHub-controlled) but pinning them is cheap and removes the "which are trusted vs. not" judgement from the maintainer. Dependabot's group setting can bundle the SHA bumps into one PR per group.

Evidence of general need
  • OpenSSF Scorecards flags "Pinned-Dependencies" for exactly this reason
  • The 2022 tj-actions/changed-files compromise was propagated via mutable tags across thousands of repositories
Alternatives considered
  • Rely on GitHub's dependabot/renovate policy alone — does not defend against tag movement between updater runs

Discovered in the v3 diff review (executor 06 finding F-CI-02).

Dominant language
TypeScript
Stars
229
Forks
45
Avg merge
1m
Merged PRs (30d)
4

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from aws-samples/serverless-full-stack-webapp-starter-kit

All issues in aws-samples/serverless-full-stack-webapp-starter-kit

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.