Backport workflow-hardening fix (unpinned-uses) to 5 release branches

Abierto
  • ¿Algo no está bien?
#6,941 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 2 días

@oindrilakha12-ui ya está trabajando en esto.

Desde el 5/7/2026.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
62/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Tranquilo
Stack tecnológico
github-actions, yaml
Área
ci-cd, devops, security

Línea de trabajo

Start with .github/workflows/build_tool.yaml on each of the five listed release branches and compare it with the default-branch fix at commit 4e74757d99a34378f1c6141ff8ff56f7f0ab4c12. Apply the documented action pinning changes, then run zizmor and actionlint for each branch. Done means the unpinned-uses findings are cleared without new findings.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Summary

The default branch already hardened .github/workflows/build_tool.yaml against the issue(s) below, but 5 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)
  • unpinned-uses — actions referenced by mutable tag/branch instead of a pinned commit SHA

Already resolved on the default branch in:

Affected release branches (5)
  • release-v0.48.x (still present as of HEAD 2f57e0ab)
  • release-v0.50.x (still present as of HEAD ef960273)
  • release-v0.49.x (still present as of HEAD af2d2270)
  • release-v0.47.x (still present as of HEAD ee2011f6)
  • release-v0.46.x (still present as of HEAD e57ade14)
Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

release-v0.48.x — unpinned-uses

File .github/workflows/build_tool.yaml; suggested edits:

    • jobs.$J.steps[uses=docker/setup-buildx-action].uses = 'docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349'
    • jobs.$J.steps[uses=docker/setup-qemu-action].uses = 'docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf'
  • ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J.steps[uses=docker/build-push-action].uses : pin(docker/build-push-action -> target_ref SHA)
--- a/.github/workflows/build_tool.yaml
+++ b/.github/workflows/build_tool.yaml
@@ -24,7 +24,7 @@
           - piped-base-okd
           - firestore-emulator
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3
         with:
           fetch-depth: 0
       - name: Determine version
release-v0.50.x — unpinned-uses

File .github/workflows/build_tool.yaml; suggested edits:

    • jobs.$J.steps[uses=docker/setup-buildx-action].uses = 'docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349'
    • jobs.$J.steps[uses=docker/setup-qemu-action].uses = 'docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf'
  • ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J.steps[uses=docker/build-push-action].uses : pin(docker/build-push-action -> target_ref SHA)
--- a/.github/workflows/build_tool.yaml
+++ b/.github/workflows/build_tool.yaml
@@ -24,7 +24,7 @@
           - piped-base-okd
           - firestore-emulator
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3
         with:
           fetch-depth: 0
       - name: Determine version
release-v0.49.x — unpinned-uses

File .github/workflows/build_tool.yaml; suggested edits:

    • jobs.$J.steps[uses=docker/setup-buildx-action].uses = 'docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349'
    • jobs.$J.steps[uses=docker/setup-qemu-action].uses = 'docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf'
  • ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J.steps[uses=docker/build-push-action].uses : pin(docker/build-push-action -> target_ref SHA)
--- a/.github/workflows/build_tool.yaml
+++ b/.github/workflows/build_tool.yaml
@@ -24,7 +24,7 @@
           - piped-base-okd
           - firestore-emulator
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3
         with:
           fetch-depth: 0
       - name: Determine version
release-v0.47.x — unpinned-uses

File .github/workflows/build_tool.yaml; suggested edits:

    • jobs.$J.steps[uses=docker/setup-buildx-action].uses = 'docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349'
    • jobs.$J.steps[uses=docker/setup-qemu-action].uses = 'docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf'
  • ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J.steps[uses=docker/build-push-action].uses : pin(docker/build-push-action -> target_ref SHA)
--- a/.github/workflows/build_tool.yaml
+++ b/.github/workflows/build_tool.yaml
@@ -23,7 +23,7 @@
           - piped-base-okd
           - firestore-emulator
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3
         with:
           fetch-depth: 0
       - name: Determine version
release-v0.46.x — unpinned-uses

File .github/workflows/build_tool.yaml; suggested edits:

    • jobs.$J.steps[uses=docker/setup-buildx-action].uses = 'docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349'
    • jobs.$J.steps[uses=docker/setup-qemu-action].uses = 'docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf'
  • ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J.steps[uses=docker/build-push-action].uses : pin(docker/build-push-action -> target_ref SHA)
--- a/.github/workflows/build_tool.yaml
+++ b/.github/workflows/build_tool.yaml
@@ -23,7 +23,7 @@
           - piped-base-okd
           - firestore-emulator
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3
         with:
           fetch-depth: 0
       - name: Determine version

Happy to open pull requests instead if that's preferred.

Lenguaje dominante
Go
Estrellas
1.4k
Forks
391
Merge medio
4 d 1 h
PR fusionados (30 d)
58

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de pipe-cd/pipecd

Todos los issues de pipe-cd/pipecd

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.