From e45aaa4d4f4ac24ef02a7510b0f891615b85e496 Mon Sep 17 00:00:00 2001 From: GaltRanch Date: Sun, 24 May 2026 10:13:20 -0300 Subject: [PATCH 1/2] ci: pin third-party Actions to commit SHAs (CWE-829) Signed-off-by: GaltRanch --- .github/workflows/build-doc-reusable.yml | 2 +- .github/workflows/build-run-app-reusable.yml | 2 +- .github/workflows/changelog.yml | 2 +- .github/workflows/codeql-reusable.yml | 4 ++-- .github/workflows/format-check.yml | 4 ++-- .github/workflows/mcdc-reusable.yml | 4 ++-- .github/workflows/unit-test-coverage-reusable.yml | 2 +- 7 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/build-doc-reusable.yml b/.github/workflows/build-doc-reusable.yml index 1bc5320b7..1ca27dddb 100644 --- a/.github/workflows/build-doc-reusable.yml +++ b/.github/workflows/build-doc-reusable.yml @@ -53,7 +53,7 @@ jobs: should_skip: ${{ steps.skip_check.outputs.should_skip }} steps: - id: skip_check - uses: fkirc/skip-duplicate-actions@master + uses: fkirc/skip-duplicate-actions@04a1aebece824b56e6ad6a401d015479cd1c50b3 # master with: concurrent_skipping: 'same_content' skip_after_successful_duplicate: 'true' diff --git a/.github/workflows/build-run-app-reusable.yml b/.github/workflows/build-run-app-reusable.yml index 7478b8e7c..a3e3c7ed8 100644 --- a/.github/workflows/build-run-app-reusable.yml +++ b/.github/workflows/build-run-app-reusable.yml @@ -46,7 +46,7 @@ jobs: should_skip: ${{ steps.skip_check.outputs.should_skip }} steps: - id: skip_check - uses: fkirc/skip-duplicate-actions@master + uses: fkirc/skip-duplicate-actions@04a1aebece824b56e6ad6a401d015479cd1c50b3 # master with: concurrent_skipping: 'same_content' skip_after_successful_duplicate: 'true' diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml index 24e1697a7..def659f1c 100644 --- a/.github/workflows/changelog.yml +++ b/.github/workflows/changelog.yml @@ -18,7 +18,7 @@ jobs: - uses: actions/checkout@v6 - name: Run Changelog - uses: heinrichreimer/github-changelog-generator-action@v2.1.1 + uses: heinrichreimer/github-changelog-generator-action@04f64206d10b4f9c882da8157ffc3dfa6ce66b3e # v2.1.1 with: token: ${{ secrets.GITHUB_TOKEN }} issuesLabel: "### Closed issues" diff --git a/.github/workflows/codeql-reusable.yml b/.github/workflows/codeql-reusable.yml index e8119bf58..5857995fa 100644 --- a/.github/workflows/codeql-reusable.yml +++ b/.github/workflows/codeql-reusable.yml @@ -74,7 +74,7 @@ jobs: should_skip: ${{ steps.skip_check.outputs.should_skip }} steps: - id: skip_check - uses: fkirc/skip-duplicate-actions@master + uses: fkirc/skip-duplicate-actions@04a1aebece824b56e6ad6a401d015479cd1c50b3 # master with: concurrent_skipping: 'same_content' skip_after_successful_duplicate: 'true' @@ -164,7 +164,7 @@ jobs: sed -i 's/"name" : "CodeQL"/"name" : "CodeQL-${{ matrix.scan-type }}"/g' CodeQL-Sarif-${{ matrix.scan-type }}/Codeql-${{ matrix.scan-type }}.sarif - name: filter-sarif - uses: advanced-security/filter-sarif@v1 + uses: advanced-security/filter-sarif@f3b8118a9349d88f7b1c0c488476411145b6270d # v1 with: patterns: | -**/*.md diff --git a/.github/workflows/format-check.yml b/.github/workflows/format-check.yml index 9d6d0da16..639c7fbaf 100644 --- a/.github/workflows/format-check.yml +++ b/.github/workflows/format-check.yml @@ -23,7 +23,7 @@ jobs: should_skip: ${{ steps.skip_check.outputs.should_skip }} steps: - id: skip_check - uses: fkirc/skip-duplicate-actions@master + uses: fkirc/skip-duplicate-actions@04a1aebece824b56e6ad6a401d015479cd1c50b3 # master with: concurrent_skipping: 'same_content' skip_after_successful_duplicate: 'true' @@ -74,7 +74,7 @@ jobs: steps: # Check each commit message associated with the pull-request against the pattern. - name: Check each commit message - uses: gsactions/commit-message-checker@v2 + uses: gsactions/commit-message-checker@16fa2d5de096ae0d35626443bcd24f1e756cafee # v2 if: always() with: pattern: '^((Fix|HotFix|Part|Issue|Ticket)\s(nasa/)?[a-zA-Z]*\#[0-9]+[,:]\s[a-zA-Z0-9]+|Merge\spull\srequest\s\#[0-9]+\s[a-zA-Z0-9]+|IC:\s[a-zA-Z0-9]+)' diff --git a/.github/workflows/mcdc-reusable.yml b/.github/workflows/mcdc-reusable.yml index f21229788..fee78c271 100644 --- a/.github/workflows/mcdc-reusable.yml +++ b/.github/workflows/mcdc-reusable.yml @@ -33,7 +33,7 @@ jobs: should_skip: ${{ steps.skip_check.outputs.should_skip }} steps: - id: skip_check - uses: fkirc/skip-duplicate-actions@master + uses: fkirc/skip-duplicate-actions@04a1aebece824b56e6ad6a401d015479cd1c50b3 # master with: concurrent_skipping: 'same_content' skip_after_successful_duplicate: 'false' @@ -145,7 +145,7 @@ jobs: - name: Download latest main branch artifact continue-on-error: true - uses: dawidd6/action-download-artifact@v2 + uses: dawidd6/action-download-artifact@268677152d06ba59fcec7a7f0b5d961b6ccd7e1e # v2 with: github_token: ${{ secrets.GITHUB_TOKEN }} workflow: mcdc.yml diff --git a/.github/workflows/unit-test-coverage-reusable.yml b/.github/workflows/unit-test-coverage-reusable.yml index b4862dd2f..20eaeed46 100644 --- a/.github/workflows/unit-test-coverage-reusable.yml +++ b/.github/workflows/unit-test-coverage-reusable.yml @@ -41,7 +41,7 @@ jobs: should_skip: ${{ steps.skip_check.outputs.should_skip }} steps: - id: skip_check - uses: fkirc/skip-duplicate-actions@master + uses: fkirc/skip-duplicate-actions@04a1aebece824b56e6ad6a401d015479cd1c50b3 # master with: concurrent_skipping: 'same_content' skip_after_successful_duplicate: 'true' From f4fb45000e26818462f3e0cb2aad314cb05d2d3c Mon Sep 17 00:00:00 2001 From: GaltRanch Date: Thu, 28 May 2026 11:33:43 -0300 Subject: [PATCH 2/2] =?UTF-8?q?ci:=20drop=20advanced-security/filter-sarif?= =?UTF-8?q?=20pin=20=E2=80=94=20GitHub-owned=20action?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Following maintainer feedback on nasa/fprime#5189: the appropriate criterion for third-party Action SHA pinning is (a) the action is NOT owned by the same org / GitHub-controlled, AND (b) the action does not opt into GitHub Immutable Releases for the version in use. advanced-security/filter-sarif is published by GitHub Advanced Security (github.com/advanced-security, blog: github.com). It is functionally a first-party GitHub action despite living outside the actions/ and github/ namespaces, and therefore should not have been pinned. Reverts the pin on .github/workflows/codeql-reusable.yml:167 only. All other third-party pins in this PR remain in scope (codecov/*, fkirc/*, heinrichreimer/*, gsactions/*, dawidd6/*) — none of them are GitHub-owned or use immutable releases as of writing. Signed-off-by: GaltRanch --- .github/workflows/codeql-reusable.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql-reusable.yml b/.github/workflows/codeql-reusable.yml index 5857995fa..24cfb74fb 100644 --- a/.github/workflows/codeql-reusable.yml +++ b/.github/workflows/codeql-reusable.yml @@ -164,7 +164,7 @@ jobs: sed -i 's/"name" : "CodeQL"/"name" : "CodeQL-${{ matrix.scan-type }}"/g' CodeQL-Sarif-${{ matrix.scan-type }}/Codeql-${{ matrix.scan-type }}.sarif - name: filter-sarif - uses: advanced-security/filter-sarif@f3b8118a9349d88f7b1c0c488476411145b6270d # v1 + uses: advanced-security/filter-sarif@v1 with: patterns: | -**/*.md