Pin GitHub Actions to SHA digests (zizmor unpinned-uses)
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
Research direction
Start with the workflow files under .github/workflows/ and run npx pin-github-action .github/workflows/*.yml to identify the three unpinned Action references. The work is done when each reference uses a full commit SHA, with its version comment retained where applicable, and the zizmor unpinned-uses findings are resolved.
Written by the indexing model from the issue text.
Description
Pin GitHub Actions to SHA digests
Zizmor detected 3 unpinned-uses findings in .github/workflows/.
GitHub Actions referenced by tag (e.g. actions/checkout@v4) are vulnerable to tag mutation — a compromised or hijacked tag can introduce malicious code into CI runs. Pinning to a full commit SHA (e.g. actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4) eliminates this supply-chain risk.
Fix
Run pin-github-action to update all workflow files automatically:
npx pin-github-action .github/workflows/*.yml
Recommendations
- Dependabot: Add a
.github/dependabot.ymlwith agithub-actionsentry so pinned SHAs are updated automatically when new Action versions are released. - zizmor-action: Add zizmor-action for continuous workflow security scanning in CI.
References
Opened by ds-security-scanning zizmor-cli-unpinned-uses
- Dominant language
- Shell
- Stars
- 330
- Forks
- 33
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from developmentseed/eoAPI
-
bug
Difficulty 1/5 Under an hour Newbie friendliness 70/100
developmentseed/eoAPI#190 · 1 reaction ·
-
developmentseed/eoAPI#229 · 1 comment · 1 reaction · 1 assignee ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 38/100
developmentseed/eoAPI#215 · 1 reaction ·
-
Feature Request
developmentseed/eoAPI#193 · 5 comments · 1 assignee ·
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 25/100
developmentseed/eoAPI#191 · 1 comment · 1 reaction ·
All issues in developmentseed/eoAPI
Similar issues
-
docs(agents): strengthen the no-backslash-escaped-backticks rule with an issue-creation example Open
Difficulty 1/5 Under an hour Newbie friendliness 92/100
-
package-update
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
oSoWoSo/vOid_Community_repOsitory#148 · 1 comment ·
-
chore
Difficulty 1/5 Under an hour Newbie friendliness 91/100
alunduil/alunduil-chezmoi#792 ·
-
area: compat bug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
zenhub-dev
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
OpenLiberty/ci.docker#747 ·