Backport workflow-hardening fix (unpinned-uses) to 5 release branches

未关闭

#6,941 创建于 2026年6月29日 1 条评论 0 个 reaction 已指派 0 人在 GitHub 查看

维护者通常 2 天内回复

@oindrilakha12-ui 已经在做这个了。

开始于 2026年7月5日。

评估

难度: 3/5
预计耗时: 1-2 天
新手友好度: 62/100

Issue 类型: 缺陷
描述清晰度: 描述清楚
活跃度: 冷清
技术栈: github-actions, yaml
领域: ci-cd, devops, security

调研方向

Start with .github/workflows/build_tool.yaml on each of the five listed release branches and compare it with the default-branch fix at commit 4e74757d99a34378f1c6141ff8ff56f7f0ab4c12. Apply the documented action pinning changes, then run zizmor and actionlint for each branch. Done means the unpinned-uses findings are cleared without new findings.

由索引模型根据 Issue 内容生成。

描述

Summary

The default branch already hardened .github/workflows/build_tool.yaml against the issue(s) below, but 5 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)

unpinned-uses — actions referenced by mutable tag/branch instead of a pinned commit SHA

Already resolved on the default branch in:

https://github.com/pipe-cd/pipecd/commit/4e74757d99a34378f1c6141ff8ff56f7f0ab4c12

Affected release branches (5)

release-v0.48.x (still present as of HEAD 2f57e0ab)
release-v0.50.x (still present as of HEAD ef960273)
release-v0.49.x (still present as of HEAD af2d2270)
release-v0.47.x (still present as of HEAD ee2011f6)
release-v0.46.x (still present as of HEAD e57ade14)

Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

release-v0.48.x — unpinned-uses

File .github/workflows/build_tool.yaml; suggested edits:

- jobs.$J.steps[uses=docker/setup-buildx-action].uses = 'docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349'
- jobs.$J.steps[uses=docker/setup-qemu-action].uses = 'docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf'
~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
~ jobs.$J.steps[uses=docker/build-push-action].uses : pin(docker/build-push-action -> target_ref SHA)

--- a/.github/workflows/build_tool.yaml
+++ b/.github/workflows/build_tool.yaml
@@ -24,7 +24,7 @@
           - piped-base-okd
           - firestore-emulator
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3
         with:
           fetch-depth: 0
       - name: Determine version

release-v0.50.x — unpinned-uses

File .github/workflows/build_tool.yaml; suggested edits:

- jobs.$J.steps[uses=docker/setup-buildx-action].uses = 'docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349'
- jobs.$J.steps[uses=docker/setup-qemu-action].uses = 'docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf'
~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
~ jobs.$J.steps[uses=docker/build-push-action].uses : pin(docker/build-push-action -> target_ref SHA)

--- a/.github/workflows/build_tool.yaml
+++ b/.github/workflows/build_tool.yaml
@@ -24,7 +24,7 @@
           - piped-base-okd
           - firestore-emulator
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3
         with:
           fetch-depth: 0
       - name: Determine version

release-v0.49.x — unpinned-uses

File .github/workflows/build_tool.yaml; suggested edits:

- jobs.$J.steps[uses=docker/setup-buildx-action].uses = 'docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349'
- jobs.$J.steps[uses=docker/setup-qemu-action].uses = 'docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf'
~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
~ jobs.$J.steps[uses=docker/build-push-action].uses : pin(docker/build-push-action -> target_ref SHA)

--- a/.github/workflows/build_tool.yaml
+++ b/.github/workflows/build_tool.yaml
@@ -24,7 +24,7 @@
           - piped-base-okd
           - firestore-emulator
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3
         with:
           fetch-depth: 0
       - name: Determine version

release-v0.47.x — unpinned-uses

File .github/workflows/build_tool.yaml; suggested edits:

- jobs.$J.steps[uses=docker/setup-buildx-action].uses = 'docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349'
- jobs.$J.steps[uses=docker/setup-qemu-action].uses = 'docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf'
~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
~ jobs.$J.steps[uses=docker/build-push-action].uses : pin(docker/build-push-action -> target_ref SHA)

--- a/.github/workflows/build_tool.yaml
+++ b/.github/workflows/build_tool.yaml
@@ -23,7 +23,7 @@
           - piped-base-okd
           - firestore-emulator
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3
         with:
           fetch-depth: 0
       - name: Determine version

release-v0.46.x — unpinned-uses

File .github/workflows/build_tool.yaml; suggested edits:

- jobs.$J.steps[uses=docker/setup-buildx-action].uses = 'docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349'
- jobs.$J.steps[uses=docker/setup-qemu-action].uses = 'docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf'
~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
~ jobs.$J.steps[uses=docker/build-push-action].uses : pin(docker/build-push-action -> target_ref SHA)

--- a/.github/workflows/build_tool.yaml
+++ b/.github/workflows/build_tool.yaml
@@ -23,7 +23,7 @@
           - piped-base-okd
           - firestore-emulator
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3
         with:
           fetch-depth: 0
       - name: Determine version

Happy to open pull requests instead if that's preferred.

主要语言: Go
星标: 1.4k
派生: 391
平均合并: 4 天 1 小时
30 天内合并 PR: 58

环境准备

没有 Dockerfile 或 Docker Compose 文件
有 Pull Request 模板
阅读贡献指南

从这里开始

先读完整个 Issue，再读项目的贡献指南。
在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
Fork 仓库，在一个分支上完成修改。
提交 Pull Request，并在描述里引用这个 Issue 编号。

pipe-cd/pipecd 的其他 Issue

Applications at the repository root are not triggered by new commits
可能已有人在做 @Daksha1611 今天认领。未关闭
- 哪里不对？
难度 2/5 1-3 小时新手友好度 62/100

pipe-cd/pipecd#7639 · 2026年11月14日创建

维护者通常 2 天内回复
pipedv1 kubernetes plugins ignore trafficRouting.istio.host in K8S_TRAFFIC_ROUTING
可能已有人在做 @Dhirenderchoudhary 今天认领。未关闭
- 哪里不对？
难度 2/5 半天新手友好度 74/100

pipe-cd/pipecd#7626 · 1 条评论 · 2026年11月13日创建

维护者通常 2 天内回复
Datadog analysis logs read millisecond timestamps as seconds
未关闭
- 哪里不对？
难度 2/5 1-3 小时新手友好度 72/100

pipe-cd/pipecd#7625 · 2026年11月13日创建

维护者通常 2 天内回复
pipectl transfer restore application drops backed-up labels
可能已有人在做 @bhavishyajain545 于 1 天前认领。未关闭
- 哪里不对？
难度 2/5 1-3 小时新手友好度 86/100

pipe-cd/pipecd#7622 · 1 条评论 · 2026年11月12日创建

维护者通常 2 天内回复
ECS plan preview misses changes to cluster in servicedef.yaml
未关闭
- 哪里不对？
难度 2/5 1-3 小时新手友好度 83/100

pipe-cd/pipecd#7621 · 2026年11月12日创建

维护者通常 2 天内回复

查看 pipe-cd/pipecd 的全部 Issue

相似的 Issue

IsTextFile reads the whole file into memory (OOM on large files in the file watcher)
可能已有人在做关联的 PR 仍在进行中或已合并。未关闭
- 哪里不对？
难度 2/5 1-3 小时新手友好度 68/100

gtsteffaniak/filebrowser#3395 · 2026年11月15日创建

维护者通常 1 天内回复
intake-class-routing README §4.5 claims an unpublished judgment stays owed; it does not
未关闭
- 哪里不对？
effort:s impact:low raised-by:worker risk:low

难度 1/5 1 小时以内新手友好度 70/100

medici-finance/assay#6496 · 1 条评论 · 2026年11月15日创建

维护者通常 1 天内回复
[BUG] Upgrade from v1.10.x re-applies the v1.4.0 csi-driver ClusterRole (lexical version check), blocking mcc-harvester with an SSA conflict
未关闭
- 哪里不对？
kind/bug require/reproduce require/severity

难度 2/5 1-3 小时新手友好度 75/100

harvester/harvester#12308 · 2026年11月15日创建

维护者通常 1 天内回复
A bare $options filter operator matches every document instead of failing
未关闭
- 哪里不对？
难度 2/5 1-3 小时新手友好度 68/100

dolthub/dumbodb#303 · 2026年11月15日创建

维护者通常 1 天内回复
🚨 configlet sync --test found unsynced tests
未关闭
- 哪里不对？
难度 2/5 1-3 小时新手友好度 60/100

exercism/go#3189 · 2026年11月15日创建

更多 Go Issue

精选适合新手参与的 GitHub issue 摘要。