[GH-ISSUE #3434] ci: external GitHub Actions are pinned by mutable tags, not commit SHAs #1279

New issue

Closed

opened 2026-10-16 21:03:42 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-16 21:03:42 +00:00

Owner

Originally created by @GovinduSasanka on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3434

Every workflow references external actions by major tag (actions/checkout@v4, actions/setup-node@v4/@v6, googleapis/release-please-action@v4, cloudflare/wrangler-action@v4, and others). Only reactivecircus/android-emulator-runner is SHA-pinned.

Why it matters: an action's owner can move a tag, or an attacker who compromises the action can, and that silently changes the code that runs in jobs holding RELEASE_PLEASE_TOKEN, the npm OIDC publishing identity (id-token: write), and the Cloudflare API token.

Expected: pin each external uses: to the full commit SHA its tag names today, with the version as a trailing comment (@<sha> # v4.4.0) so Dependabot/Renovate can still bump it, and add a test that rejects new tag-only references.

Reviewed at fa4b828. A PR follows.

Originally created by @GovinduSasanka on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3434 Every workflow references external actions by major tag (`actions/checkout@v4`, `actions/setup-node@v4/@v6`, `googleapis/release-please-action@v4`, `cloudflare/wrangler-action@v4`, and others). Only `reactivecircus/android-emulator-runner` is SHA-pinned. **Why it matters:** an action's owner can move a tag, or an attacker who compromises the action can, and that silently changes the code that runs in jobs holding `RELEASE_PLEASE_TOKEN`, the npm OIDC publishing identity (`id-token: write`), and the Cloudflare API token. **Expected:** pin each external `uses:` to the full commit SHA its tag names today, with the version as a trailing comment (`@<sha> # v4.4.0`) so Dependabot/Renovate can still bump it, and add a test that rejects new tag-only references. Reviewed at fa4b828. A PR follows.

bsakaguchi closed this issue

2026-10-16 21:03:43 +00:00

bsakaguchi commented

2026-10-16 21:03:44 +00:00

Author

Owner

@GovinduSasanka commented on GitHub (Oct 14, 2026):

Correction: I filed this against an older checkout. #1901 already pinned the workflows to SHAs. On current main only .github/workflows/real-cutter.yml still uses tags (actions/upload-artifact@v4 ×2, actions/download-artifact@v4). #3440 pins those and adds a boundary test so tag-only references can't come back unnoticed.

@GovinduSasanka commented on GitHub (Oct 14, 2026): Correction: I filed this against an older checkout. #1901 already pinned the workflows to SHAs. On current `main` only `.github/workflows/real-cutter.yml` still uses tags (`actions/upload-artifact@v4` ×2, `actions/download-artifact@v4`). #3440 pins those and adds a boundary test so tag-only references can't come back unnoticed.

bsakaguchi referenced this issue

2026-10-17 21:09:56 +00:00

[PR #1279] [CLOSED] feat: add reverse engineering tool integrations #2761

bsakaguchi referenced this issue

2026-10-31 00:57:07 +00:00

[PR #1959] feat(process): add owned debugger shutdown lifecycle #4934

bsakaguchi referenced this issue

2026-10-31 00:57:10 +00:00

[PR #1961] fix(gdb)!: preserve interrupt and provider cleanup ownership #4938