Security: Pin GitHub Actions to full commit SHAs

<html>
<body>

<html>
<head></head>
<body>

<h2> Security: Pin GitHub Actions to full commit SHAs</h2>

<h3>Problem</h3>

<p>
Our workflows currently pin GitHub Actions using mutable version tags
(for example <code>@v5</code>, <code>@v6</code>, etc.).
</p>

<p>
Version tags are mutable and may be moved to point to different commits.
In the event of a supply-chain compromise, workflows could unintentionally
execute malicious code.
</p>

<h3>Proposed fix</h3>

<p>
Pin all GitHub Actions to full-length commit SHAs while keeping the version
tag as a comment for readability.
</p>

<p>Example:</p>

<pre><code class="language-yaml"># Before
uses: actions/checkout@v6

# After
uses: actions/checkout@&lt;full-commit-sha&gt; 
</code></pre>

<h3>Actions identified</h3>

<table>
<thead>
<tr>
<th>File</th>
<th>Action</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>.github/workflows/tests.yml</code></td>
<td><code>actions/checkout</code></td>
</tr>
<tr>
<td><code>.github/workflows/tests.yml</code></td>
<td><code>actions/setup-go</code></td>
</tr>
<tr>
<td><code>.github/workflows/lint.yml</code></td>
<td><code>actions/checkout</code></td>
</tr>
<tr>
<td><code>.github/workflows/lint.yml</code></td>
<td><code>actions/setup-go</code></td>
</tr>
<tr>
<td><code>.github/workflows/build-image.yml</code></td>
<td><code>actions/checkout</code></td>
</tr>
<tr>
<td><code>.github/workflows/build-image.yml</code></td>
<td><code>docker/setup-qemu-action</code></td>
</tr>
<tr>
<td><code>.github/workflows/build-image.yml</code></td>
<td><code>docker/setup-buildx-action</code></td>
</tr>
<tr>
<td><code>.github/workflows/build-image.yml</code></td>
<td><code>docker/login-action</code></td>
</tr>
<tr>
<td><code>.github/workflows/build-image.yml</code></td>
<td><code>docker/build-push-action</code></td>
</tr>
</tbody>
</table>

<h3>Acceptance criteria</h3>

<ul>
<li>All GitHub Actions are pinned to full commit SHAs.</li>
<li>Existing CI workflows continue to pass.</li>
<li>Version comments are preserved for readability.</li>
</ul>

<h3>References</h3>

<ul>
<li>
GitHub Docs : Security hardening for GitHub Actions<br>
<a href="https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions">
More details
</a>
</li>

<li>
StepSecurity:  Pinning GitHub Actions guide<br>
<a href="https://www.stepsecurity.io/blog/pinning-github-actions-for-enhanced-security-a-complete-guide">
More details
</a>
</li>
</ul>

<hr>

<p>
I'd be happy to work on this and submit a PR if this is approved.
Please assign me if you'd like me to proceed.
</p>

</body>
</html>

</body>
</html>

File	Action
`.github/workflows/tests.yml`	`actions/checkout`
`.github/workflows/tests.yml`	`actions/setup-go`
`.github/workflows/lint.yml`	`actions/checkout`
`.github/workflows/lint.yml`	`actions/setup-go`
`.github/workflows/build-image.yml`	`actions/checkout`
`.github/workflows/build-image.yml`	`docker/setup-qemu-action`
`.github/workflows/build-image.yml`	`docker/setup-buildx-action`
`.github/workflows/build-image.yml`	`docker/login-action`
`.github/workflows/build-image.yml`	`docker/build-push-action`

Navigation Menu

Uh oh!

Security: Pin GitHub Actions to full commit SHAs #256