Pin GitHub Actions to SHA digests (zizmor unpinned-uses)
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
Research direction
Start with .github/workflows/*.yml and run the provided npx pin-github-action command to inspect the three zizmor unpinned-uses findings. Confirm every referenced GitHub Action uses a full commit SHA with a version comment, then rerun the zizmor audit to verify the findings are resolved.
Written by the indexing model from the issue text.
Description
Pin GitHub Actions to SHA digests
Zizmor detected 3 unpinned-uses findings in .github/workflows/.
GitHub Actions referenced by tag (e.g. actions/checkout@v4) are vulnerable to tag mutation — a compromised or hijacked tag can introduce malicious code into CI runs. Pinning to a full commit SHA (e.g. actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4) eliminates this supply-chain risk.
Fix
Run pin-github-action to update all workflow files automatically:
npx pin-github-action .github/workflows/*.yml
Recommendations
- Dependabot: Add a
.github/dependabot.ymlwith agithub-actionsentry so pinned SHAs are updated automatically when new Action versions are released. - zizmor-action: Add zizmor-action for continuous workflow security scanning in CI.
References
Opened by ds-security-scanning zizmor-cli-unpinned-uses
- Dominant language
- Python
- Stars
- 29
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from developmentseed/tipmtiles
-
add WMS Extension Open
Difficulty 3/5 1-2 days Newbie friendliness 35/100
-
add tests Open
Difficulty 5/5 Over a week Newbie friendliness 15/100
-
Add a tagline Open
Difficulty 1/5 Under an hour Newbie friendliness 25/100
developmentseed/tipmtiles#1 · 1 reaction ·
All issues in developmentseed/tipmtiles
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100