github/docs

OIDC examples don't pin external actions (& don't declare them)

Open

#34,316 opened on Aug 15, 2024

View on GitHub
 (9 comments) (0 reactions) (0 assignees)TypeScript (19,479 stars) (67,056 forks)batch import
SME reviewedactionscontenthelp wantednever-stale

Description

Code of Conduct

What article on docs.github.com is affected?

  1. https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-google-cloud-platform#requesting-the-access-token
  2. https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#requesting-the-access-token
  3. https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-azure#requesting-the-access-token
  4. https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-hashicorp-vault#requesting-the-access-token
  5. https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-pypi#updating-your-github-actions-workflow

What part(s) of the article would you like to see updated?

    steps:
    - id: 'auth'
      name: 'Authenticate to GCP'
      uses: 'google-github-actions/auth@v0.3.1'
      with:

should pin a hash instead, also the reusable disclaiming 3rdparty usage should be added.

Additional information

This is analogous for all the pages mentioned, for both # Requesting and # Revoking examples.

Contributor guide

Tech stack
github actions
Domain
documentationsecurity
Issue type
documentation
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
basic GitHub Actions knowledgeunderstanding of OIDC
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
80
Research direction
Update the workflow examples on the listed pages to pin the actions to a specific hash instead of a version tag, following security best practices. Add a disclaimer about using third party actions. Refer to the existing discussion in the comments for any maintainer feedback. The changes are straightforward and localized to the YAML code blocks.