Update github actions (release-v0.8) (minor) #1732
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -29,4 +29,4 @@ jobs: | |
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Label PR by size | ||
| uses: conforma/pr-size-label-action@v1.2.0 | ||
|
There was a problem hiding this comment. [medium] supply-chain conforma/pr-size-label-action is referenced by a mutable tag (v1.2.0) rather than a pinned commit SHA. This workflow runs on pull_request_target with pull-requests: write and issues: write permissions, making tag mutability a meaningful supply-chain risk. Suggested fix: Pin to a specific commit SHA corresponding to v1.2.0, following the established pattern: uses: conforma/pr-size-label-action@ # v1.2.0 There was a problem hiding this comment. [medium] pattern-inconsistency Every other third-party action in this repository uses SHA pinning with version comments (@ # ), but conforma/pr-size-label-action uses a mutable tag reference (@v1.2.0). This is a pre-existing inconsistency that this PR perpetuates. Suggested fix: Align with the repository convention: uses: conforma/pr-size-label-action@<full-sha-of-v1.2.0> # v1.2.0 There was a problem hiding this comment. [medium] supply-chain pinning The conforma/pr-size-label-action is referenced by mutable tag (v1.2.0) instead of a SHA pin. This action runs on pull_request_target with pull-requests:write and issues:write permissions, meaning a compromised or force-pushed tag could execute arbitrary code with write access to the repository. The pull_request_target trigger combined with write permissions makes this an elevated-risk combination. Suggested fix: Pin conforma/pr-size-label-action to the full commit SHA for v1.2.0. Consider also pinning other mutable-referenced actions for consistency. There was a problem hiding this comment. [low] supply-chain conforma/pr-size-label-action uses a mutable version tag (v1.2.0) instead of a SHA pin, inconsistent with the pinning strategy used for all other actions in these workflows. Pre-existing issue, not introduced by this PR. Suggested fix: Pin to the full commit SHA for v1.2.0 with a version comment, matching the pattern used by other actions (e.g., actions/setup-go@924ae3a1... # v6.5.0). There was a problem hiding this comment. [medium] pin-integrity The action conforma/pr-size-label-action@v1.2.0 is pinned to a mutable version tag rather than a full commit SHA. Every other action across all six workflow files uses SHA pinning with a version comment. A mutable tag can be force-pushed, silently replacing the action code. This workflow runs on pull_request_target with pull-requests: write and issues: write permissions, so a compromised action would execute with elevated write permissions. The risk is partially mitigated by the action being owned by the same conforma organization. Suggested fix: Pin to a full 40-character commit SHA with a version comment: uses: conforma/pr-size-label-action@ # v1.2.0. Determine the SHA by checking the v1.2.0 tag on GitHub. There was a problem hiding this comment. [low] supply-chain conforma/pr-size-label-action uses a mutable tag reference (@v1.2.0) instead of a SHA pin, unlike all other actions in the repository. Tag references can be repointed, posing a supply-chain integrity risk. This is a pre-existing pattern not introduced by this PR. Suggested fix: Pin to the commit SHA for v1.2.0 with a version comment (e.g., conforma/pr-size-label-action@ # v1.2.0), matching the convention used by all other actions in this repository. There was a problem hiding this comment. [medium] mutable action reference The action conforma/pr-size-label-action@v1.2.0 is pinned to a mutable version tag rather than an immutable commit SHA. All other actions in this repository (23 references across workflow files) use SHA pinning with version comments. A mutable tag can be force-pushed to point at arbitrary code. The risk is partially mitigated by this being an org-internal action (same conforma organization) and having limited permissions (only pull-requests: write and issues: write). Suggested fix: Pin conforma/pr-size-label-action to the full commit SHA of the v1.2.0 release and add a version comment (e.g., conforma/pr-size-label-action@ # v1.2.0). Also consider configuring Renovate to resolve SHAs for this action in future updates. There was a problem hiding this comment. [low] action-pinning The conforma/pr-size-label-action action is pinned to a mutable tag (v1.2.0) rather than a full commit SHA hash. This workflow runs on pull_request_target, which grants write tokens and access to repository secrets. This is a pre-existing pattern for conforma-organization-owned actions (the previous version v1.0.0 was also tag-pinned), not a regression introduced by this PR. Suggested fix: Consider SHA-pinning organization-owned actions for defense-in-depth, especially in workflows using pull_request_target. |
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[medium] Mutable tag pinning
The action conforma/pr-size-label-action@v1.2.0 is pinned to a mutable tag rather than a commit SHA. Every other action updated in this PR is pinned to a full commit SHA with a version comment. This workflow uses pull_request_target which runs with write permissions (pull-requests: write, issues: write), making supply-chain integrity especially important. While the action is in the same GitHub organization (conforma), the inconsistency with the pinning strategy represents an avoidable risk.
Suggested fix: Pin to the commit SHA: conforma/pr-size-label-action@9bff907 # v1.2.0, consistent with every other action reference in this repository.