Backport workflow-hardening fix (unpinned-uses) to 5 release branches

Đang mở
  • Có gì không ổn?
#6,941 1 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 2 ngày

@oindrilakha12-ui đang làm issue này rồi.

Từ ngày 5/7/2026.

Đánh giá

Độ khó
3/5
Thời gian dự kiến
1-2 ngày
Mức phù hợp với người mới
62/100
Loại issue
Lỗi
Độ rõ ràng
Đặc tả rõ ràng
Mức độ hoạt động
Ít trao đổi
Công nghệ
github-actions, yaml
Lĩnh vực
ci-cd, devops, security

Hướng nghiên cứu

Start with .github/workflows/build_tool.yaml on each of the five listed release branches and compare it with the default-branch fix at commit 4e74757d99a34378f1c6141ff8ff56f7f0ab4c12. Apply the documented action pinning changes, then run zizmor and actionlint for each branch. Done means the unpinned-uses findings are cleared without new findings.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

Summary

The default branch already hardened .github/workflows/build_tool.yaml against the issue(s) below, but 5 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)
  • unpinned-uses — actions referenced by mutable tag/branch instead of a pinned commit SHA

Already resolved on the default branch in:

Affected release branches (5)
  • release-v0.48.x (still present as of HEAD 2f57e0ab)
  • release-v0.50.x (still present as of HEAD ef960273)
  • release-v0.49.x (still present as of HEAD af2d2270)
  • release-v0.47.x (still present as of HEAD ee2011f6)
  • release-v0.46.x (still present as of HEAD e57ade14)
Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

release-v0.48.x — unpinned-uses

File .github/workflows/build_tool.yaml; suggested edits:

    • jobs.$J.steps[uses=docker/setup-buildx-action].uses = 'docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349'
    • jobs.$J.steps[uses=docker/setup-qemu-action].uses = 'docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf'
  • ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J.steps[uses=docker/build-push-action].uses : pin(docker/build-push-action -> target_ref SHA)
--- a/.github/workflows/build_tool.yaml
+++ b/.github/workflows/build_tool.yaml
@@ -24,7 +24,7 @@
           - piped-base-okd
           - firestore-emulator
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3
         with:
           fetch-depth: 0
       - name: Determine version
release-v0.50.x — unpinned-uses

File .github/workflows/build_tool.yaml; suggested edits:

    • jobs.$J.steps[uses=docker/setup-buildx-action].uses = 'docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349'
    • jobs.$J.steps[uses=docker/setup-qemu-action].uses = 'docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf'
  • ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J.steps[uses=docker/build-push-action].uses : pin(docker/build-push-action -> target_ref SHA)
--- a/.github/workflows/build_tool.yaml
+++ b/.github/workflows/build_tool.yaml
@@ -24,7 +24,7 @@
           - piped-base-okd
           - firestore-emulator
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3
         with:
           fetch-depth: 0
       - name: Determine version
release-v0.49.x — unpinned-uses

File .github/workflows/build_tool.yaml; suggested edits:

    • jobs.$J.steps[uses=docker/setup-buildx-action].uses = 'docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349'
    • jobs.$J.steps[uses=docker/setup-qemu-action].uses = 'docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf'
  • ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J.steps[uses=docker/build-push-action].uses : pin(docker/build-push-action -> target_ref SHA)
--- a/.github/workflows/build_tool.yaml
+++ b/.github/workflows/build_tool.yaml
@@ -24,7 +24,7 @@
           - piped-base-okd
           - firestore-emulator
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3
         with:
           fetch-depth: 0
       - name: Determine version
release-v0.47.x — unpinned-uses

File .github/workflows/build_tool.yaml; suggested edits:

    • jobs.$J.steps[uses=docker/setup-buildx-action].uses = 'docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349'
    • jobs.$J.steps[uses=docker/setup-qemu-action].uses = 'docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf'
  • ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J.steps[uses=docker/build-push-action].uses : pin(docker/build-push-action -> target_ref SHA)
--- a/.github/workflows/build_tool.yaml
+++ b/.github/workflows/build_tool.yaml
@@ -23,7 +23,7 @@
           - piped-base-okd
           - firestore-emulator
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3
         with:
           fetch-depth: 0
       - name: Determine version
release-v0.46.x — unpinned-uses

File .github/workflows/build_tool.yaml; suggested edits:

    • jobs.$J.steps[uses=docker/setup-buildx-action].uses = 'docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349'
    • jobs.$J.steps[uses=docker/setup-qemu-action].uses = 'docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf'
  • ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J.steps[uses=docker/build-push-action].uses : pin(docker/build-push-action -> target_ref SHA)
--- a/.github/workflows/build_tool.yaml
+++ b/.github/workflows/build_tool.yaml
@@ -23,7 +23,7 @@
           - piped-base-okd
           - firestore-emulator
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3
         with:
           fetch-depth: 0
       - name: Determine version

Happy to open pull requests instead if that's preferred.

Ngôn ngữ chính
Go
Star
1.4k
Fork
391
Merge trung bình
4 ngày 1 giờ
Pull request đã merge (30 ngày)
58

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của pipe-cd/pipecd

Tất cả issue của pipe-cd/pipecd

Issue tương tự

Thêm issue về Go

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.