Description
Two third-party GitHub Actions are referenced by mutable version tags rather than immutable full commit SHAs, exposing the build/release to supply-chain tampering if the upstream tag is moved to malicious code.
Affected:
withastro/action@v6 — .github/workflows/deploy-site.ymlsoftprops/action-gh-release@v2 — .github/workflows/release-draft.yml
Other workflows are already compliant: official actions/* and github/codeql-action/* are allowed by tag, and the Docker workflow already pins docker/*, aws-actions/*, and peter-evans/* to full SHAs.
Suggested Fix
Pin both third-party actions to a full commit SHA with a version comment, e.g.:
withastro/action@<sha> # v6
softprops/action-gh-release@<sha> # v2
Description
Two third-party GitHub Actions are referenced by mutable version tags rather than immutable full commit SHAs, exposing the build/release to supply-chain tampering if the upstream tag is moved to malicious code.
Affected:
withastro/action@v6—.github/workflows/deploy-site.ymlsoftprops/action-gh-release@v2—.github/workflows/release-draft.ymlOther workflows are already compliant: official
actions/*andgithub/codeql-action/*are allowed by tag, and the Docker workflow already pinsdocker/*,aws-actions/*, andpeter-evans/*to full SHAs.Suggested Fix
Pin both third-party actions to a full commit SHA with a version comment, e.g.: