From e71f373675b8456d31032d05b64344c261699df8 Mon Sep 17 00:00:00 2001 From: grabowski Date: Wed, 15 Jul 2026 19:54:19 +0700 Subject: [PATCH] Pin workflow actions to commit SHAs Mutable tags on third-party actions could be repointed at code that runs with the repo token; pin checkout, upload-artifact and gitea-release-action to their current commits. --- .gitea/workflows/build-pcm.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.gitea/workflows/build-pcm.yml b/.gitea/workflows/build-pcm.yml index d17d6e9..6fe64c8 100644 --- a/.gitea/workflows/build-pcm.yml +++ b/.gitea/workflows/build-pcm.yml @@ -10,7 +10,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + # third-party actions pinned to commit SHAs: mutable tags could be + # repointed at malicious code that runs with repo/token access + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Check tag matches metadata.json version if: startsWith(github.ref, 'refs/tags/v') @@ -26,7 +28,7 @@ jobs: run: python3 tools/build_package.py - name: Upload artifact - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3 with: name: pcm-package path: | @@ -35,7 +37,7 @@ jobs: - name: Create release with the zip attached if: startsWith(github.ref, 'refs/tags/v') - uses: akkuman/gitea-release-action@v1 + uses: akkuman/gitea-release-action@b8d9144f302c68610911db1aaf722708d5c02d94 # v1 with: files: | dist/*.zip