[LAUNCH-E M8, Medium] Pin GitHub Actions in CI by commit SHA
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 55/100
Research direction
Start with .github/workflows/ci.yml at the cited lines, then inspect every workflow under .github/workflows/ and verify each action’s full commit SHA in its official repository. Add a check that rejects tag-only uses: references and document how to update pins. Run make check; done means every action is SHA-pinned and the check passes.
Written by the indexing model from the issue text.
Description
Artifact: follow-up issue for audit finding M8 (Medium) of the LAUNCH-E security audit (#257, PR #279); disposition 'follow-up' recorded by the maintainer on #257. This issue body is the authoritative copy. Audited commit: 388ecb3b9d6376f8914054cc06ea5e5caab164da (main); line numbers below are at that commit.
Parent: #255 · Audit: #257 · Audit PR: #279 · Severity: Medium
Summary
.github/workflows/ci.yml pins its actions by tag (actions/checkout@v7, astral-sh/[email protected]), not by commit SHA. The workflow has contents: read and no secrets, but a moved tag could change what produces the ci check that an opened merge gate relies on.
Evidence (at 388ecb3)
.github/workflows/ci.yml:47,50,68,71,96,99.
Scope
- Pin every
uses:to a full 40-hex commit SHA with the version as a trailing comment, resolved from the action's official repository. - Add a check (test or CI lint) that fails on an unpinned
uses:, and document how to update pins (optionally Dependabot for GitHub Actions).
Acceptance criteria
- Every
uses:in.github/workflows/is pinned to a commit SHA; the check fails on a tag-only reference. -
make checkpasses and CI is green on the PR.
- Dominant language
- Python
- Stars
- 0
- Forks
- 0
- Avg merge
- 5h 57m
- Merged PRs (30d)
- 71
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from iceboundrock/AutoForge
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
iceboundrock/AutoForge#304 ·
Maintainers usually reply within 1 day
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
iceboundrock/AutoForge#333 ·
Maintainers usually reply within 1 day
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
iceboundrock/AutoForge#332 ·
Maintainers usually reply within 1 day
-
Difficulty 5/5 Over a week Newbie friendliness 1/100
iceboundrock/AutoForge#331 ·
Maintainers usually reply within 1 day
-
enhancement
Difficulty 4/5 3-5 days Newbie friendliness 45/100
iceboundrock/AutoForge#329 · 1 comment ·
Maintainers usually reply within 1 day
All issues in iceboundrock/AutoForge
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
nansencenter/geodataset#39 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
awslabs/visual-asset-management-system#804 ·
Maintainers usually reply within 1 day
-
follow-up
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
odoo/odoo#297927 · 1 comment ·
Maintainers usually reply within 1 day
-
link-rot
Difficulty 1/5 Under an hour Newbie friendliness 67/100