Change third party github actions to target specific commits rather than tags

Open
#581 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
65/100
Issue type
Refactor
Clarity
Mostly clear
Activity status
Quiet
Tech stack
github-actions
Domain
ci-cd, security

Research direction

Start by searching the repository's workflow files for third-party GitHub Actions, including the astral-sh/setup-uv@v7 example. Pin each third-party action to a specific commit instead of a tag, then run the available workflow checks to confirm they still pass.

Written by the indexing model from the issue text.

Description

We should pin our third party github actions to a specific commit, rather than a tag as we currently do.

This is a cybersecurity measure recommended by GitHub:

The individual jobs in a workflow can interact with (and compromise) other jobs. For example, a job querying the environment variables used by a later job, writing files to a shared directory that a later job processes, or even more directly by interacting with the Docker socket and inspecting other running containers and executing commands in them.

This means that a compromise of a single action within a workflow can be very significant, as that compromised action would have access to all secrets configured on your repository, and may be able to use the GITHUB_TOKEN to write to the repository. Consequently, there is significant risk in sourcing actions from third-party repositories on GitHub. For information on some of the steps an attacker could take, see Secure use reference.

In our workflows, we have some third party actions used like such:

    - name: Install uv
      uses: astral-sh/setup-uv@v7
Dominant language
Jinja
Stars
85
Forks
16
Avg merge
6h 18m
Merged PRs (30d)
1

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from lincc-frameworks/python-project-template

All issues in lincc-frameworks/python-project-template

Similar issues

More DevOps issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.