harden: github actions step uses a mutable tag or branc... in...

[anupamme]

Summary

Harden input handling in .forgejo/workflows/deploy-warm-beta.yml (flagged by semgrep).

Vulnerability

Field	Value
ID	yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
Severity	HIGH
Scanner	semgrep
Rule	yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
File	.forgejo/workflows/deploy-warm-beta.yml:16
Assessment	Defensive hardening

Description: GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

Threat Model Context

This is a containerized service - vulnerabilities may be exploitable depending on network exposure.

Changes

• .forgejo/workflows/deploy-warm-beta.yml

Behavior Preservation

The change is scoped to 1 file on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.

---

This patch removes an exploit primitive — a code pattern that, while not independently exploitable today, could be chained with other weaknesses by automated exploit-development tooling. Proactive removal of such primitives raises the bar against increasingly capable automated attack tools.

---

Automated security fix by OrbisAI Security

[vercel]

@anupamme is attempting to deploy a commit to the Nerual Dreming's projects Team on Vercel.

A member of the Team first needs to authorize it.