Skip to content

Commit d32db2d

Browse files
jrfnljrfnl
committed
GH Actions: "pin" all action runners
Recently there has been more and more focus on securing GH Actions workflows - in part due to some incidents. The problem with "unpinned" action runners is as follows: * Tags are mutable, which means that a tag could point to a safe commit today, but to a malicious commit tomorrow. Note that GitHub is currently beta-testing a new "immutable releases" feature (= tags and release artifacts can not be changed anymore once the release is published), but whether that has much effect depends on the ecosystem of the packages using the feature. Aside from that, it will likely take years before all projects adopt _immutable releases_. * Action runners often don't even point to a tag, but to a branch, making the used action runner a moving target. _Note: this type of "floating major" for action runners used to be promoted as good practice when the ecosystem was "young". Insights have since changed._ While it is convenient to use "floating majors" of action runners, as this means you only need to update the workflows on a new major release of the action runner, the price is higher risk of malicious code being executed in workflows. Dependabot, by now, can automatically submit PRs to update pinned action runners too, as long as the commit-hash pinned runner is followed by a comment listing the released version the commit is pointing to. So, what with Dependabot being capable of updating workflows with pinned action runners, I believe it is time to update the workflows to the _current_ best practice of using commit-hash pinned action runners. The downside of this change is that there will be more frequent Dependabot PRs. If this would become a burden/irritating, the following mitigations can be implemented: 1. Updating the Dependabot config to group updates instead of sending individual PRs per action runner. 2. A workflow to automatically merge Dependabot PRs as long as CI passes. Ref: https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions
1 parent 9d00e0e commit d32db2d

10 files changed

+54
-54
lines changed

‎.github/workflows/end-to-end-tests.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,10 +39,10 @@ jobs:
3939
run: git config --global core.autocrlf input
4040

4141
- name: Checkout code
42-
uses: actions/checkout@v5
42+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
4343

4444
- name: Install PHP
45-
uses: shivammathur/setup-php@v2
45+
uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f # 2.35.5
4646
with:
4747
php-version: ${{ matrix.php }}
4848
ini-values: "error_reporting=-1, display_errors=On, display_startup_errors=On"

‎.github/workflows/happy-new-year.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -49,13 +49,13 @@ jobs:
4949
run: "echo current year: ${{ steps.year.outputs.NEW_YEAR }} - previous year: ${{ steps.year.outputs.PREVIOUS_YEAR }}"
5050

5151
- name: Checkout code
52-
uses: actions/checkout@v5
52+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
5353
with:
5454
ref: ${{ steps.branches.outputs.BASE }}
5555

5656
- name: Update the year in the copyright tag in the fixed file
5757
id: findreplace
58-
uses: jacobtomlinson/gha-find-replace@v3
58+
uses: jacobtomlinson/gha-find-replace@f1069b438f125e5395d84d1c6fd3b559a7880cb5 # 3.0.5
5959
with:
6060
find: "* @copyright ${{ steps.year.outputs.PREVIOUS_YEAR }} Squiz Pty Ltd (ABN 77 084 670 600)"
6161
replace: "* @copyright ${{ steps.year.outputs.NEW_YEAR }} Squiz Pty Ltd (ABN 77 084 670 600)"
@@ -73,7 +73,7 @@ jobs:
7373
run: exit 1
7474

7575
- name: Create pull request
76-
uses: peter-evans/create-pull-request@v7
76+
uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
7777
with:
7878
base: ${{ steps.branches.outputs.BASE }}
7979
branch: ${{ steps.branches.outputs.PR_BRANCH }}

‎.github/workflows/label-merge-conflicts.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ jobs:
2222

2323
steps:
2424
- name: Check PRs for merge conflicts
25-
uses: eps1lon/actions-label-merge-conflict@v3
25+
uses: eps1lon/actions-label-merge-conflict@1df065ebe6e3310545d4f4c4e862e43bdca146f0 # v3.0.3
2626
with:
2727
dirtyLabel: "Status: has merge conflict"
2828
repoToken: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/label-new-prs.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ jobs:
2525

2626
steps:
2727
- name: Label new PRs
28-
uses: srvaroa/labeler@v1
28+
uses: srvaroa/labeler@0a20eccb8c94a1ee0bed5f16859aece1c45c3e55 # v1.13.0
2929
env:
3030
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
3131

@@ -38,10 +38,10 @@ jobs:
3838
steps:
3939
# Checkout is needed to use the `use_local_config` option.
4040
- name: Checkout code
41-
uses: actions/checkout@v5
41+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
4242

4343
- name: Verify changes to the labeling logic
44-
uses: srvaroa/labeler@v1
44+
uses: srvaroa/labeler@0a20eccb8c94a1ee0bed5f16859aece1c45c3e55 # v1.13.0
4545
with:
4646
use_local_config: true
4747
fail_on_error: true

‎.github/workflows/label-remove-outdated.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
name: Clean up labels on issue close
1919

2020
steps:
21-
- uses: mondeja/remove-labels-gh-action@v2
21+
- uses: mondeja/remove-labels-gh-action@b7118e4ba5dca74acf1059b3cb7660378ff9ab1a # v2.0.0
2222
with:
2323
token: ${{ secrets.GITHUB_TOKEN }}
2424
labels: |
@@ -35,7 +35,7 @@ jobs:
3535
name: "Clean up labels on PR (re-)review request"
3636

3737
steps:
38-
- uses: mondeja/remove-labels-gh-action@v2
38+
- uses: mondeja/remove-labels-gh-action@b7118e4ba5dca74acf1059b3cb7660378ff9ab1a # v2.0.0
3939
with:
4040
token: ${{ secrets.GITHUB_TOKEN }}
4141
labels: |
@@ -48,7 +48,7 @@ jobs:
4848
name: Clean up labels on PR merge
4949

5050
steps:
51-
- uses: mondeja/remove-labels-gh-action@v2
51+
- uses: mondeja/remove-labels-gh-action@b7118e4ba5dca74acf1059b3cb7660378ff9ab1a # v2.0.0
5252
with:
5353
token: ${{ secrets.GITHUB_TOKEN }}
5454
labels: |
@@ -68,7 +68,7 @@ jobs:
6868
name: Clean up labels on PR close
6969

7070
steps:
71-
- uses: mondeja/remove-labels-gh-action@v2
71+
- uses: mondeja/remove-labels-gh-action@b7118e4ba5dca74acf1059b3cb7660378ff9ab1a # v2.0.0
7272
with:
7373
token: ${{ secrets.GITHUB_TOKEN }}
7474
labels: |

‎.github/workflows/quicktest.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -49,10 +49,10 @@ jobs:
4949
run: git config --global core.autocrlf input
5050

5151
- name: Checkout code
52-
uses: actions/checkout@v5
52+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
5353

5454
- name: Install PHP
55-
uses: shivammathur/setup-php@v2
55+
uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f # 2.35.5
5656
with:
5757
php-version: ${{ matrix.php }}
5858
ini-values: 'error_reporting=-1, display_errors=On, display_startup_errors=On'
@@ -61,7 +61,7 @@ jobs:
6161
# Install dependencies and handle caching in one go.
6262
# @link https://github.com/marketplace/actions/install-php-dependencies-with-composer
6363
- name: Install Composer dependencies
64-
uses: "ramsey/composer-install@v3"
64+
uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # 3.1.1
6565
with:
6666
# Bust the cache at least once a month - output format: YYYY-MM.
6767
custom-cache-suffix: $(date -u "+%Y-%m")

‎.github/workflows/reusable-build-phar.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -33,10 +33,10 @@ jobs:
3333

3434
steps:
3535
- name: Checkout code
36-
uses: actions/checkout@v5
36+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
3737

3838
- name: Setup PHP
39-
uses: shivammathur/setup-php@v2
39+
uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f # 2.35.5
4040
with:
4141
php-version: ${{ inputs.phpVersion }}
4242
coverage: none
@@ -48,15 +48,15 @@ jobs:
4848
# Provide provenance for generated binaries.
4949
- name: Generate artifact attestations
5050
if: ${{ inputs.createAttestations == true }}
51-
uses: actions/attest-build-provenance@v3
51+
uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
5252
with:
5353
subject-path: |
5454
${{ github.workspace }}/phpcs.phar
5555
${{ github.workspace }}/phpcbf.phar
5656
5757
- name: Upload the PHPCS phar
5858
if: ${{ inputs.uploadArtifacts == true }}
59-
uses: actions/upload-artifact@v4
59+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
6060
with:
6161
name: phpcs-phar
6262
path: ./phpcs.phar
@@ -65,7 +65,7 @@ jobs:
6565

6666
- name: Upload the PHPCBF phar
6767
if: ${{ inputs.uploadArtifacts == true }}
68-
uses: actions/upload-artifact@v4
68+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
6969
with:
7070
name: phpcbf-phar
7171
path: ./phpcbf.phar

‎.github/workflows/test.yml‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -114,12 +114,12 @@ jobs:
114114
run: git config --global core.autocrlf input
115115

116116
- name: Checkout code
117-
uses: actions/checkout@v5
117+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
118118

119119
- name: "libxml2: find the latest relevant tag"
120120
if: ${{ matrix.libxml_minor }}
121121
id: libxml_version
122-
uses: oprypin/find-latest-tag@v1
122+
uses: oprypin/find-latest-tag@dd2729fe78b0bb55523ae2b2a310c6773a652bd1 # v1.1.2
123123
with:
124124
repository: GNOME/libxml2
125125
releases-only: false # The libxml2 repository doesn't use GitHub's "release" feature.
@@ -138,7 +138,7 @@ jobs:
138138
- name: "libxml2: restore cache"
139139
if: ${{ matrix.libxml_minor }}
140140
id: libxml_cache_restore
141-
uses: actions/cache/restore@v4
141+
uses: actions/cache/restore@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
142142
with:
143143
path: "libxml2-${{ steps.libxml_patch_version.outputs.PATCH }}"
144144
key: "${{ matrix.os }}-libxml-${{ matrix.libxml_minor }}-${{ steps.libxml_patch_version.outputs.PATCH }}"
@@ -166,7 +166,7 @@ jobs:
166166
- name: "libxml2: save cache"
167167
if: ${{ matrix.libxml_minor && steps.libxml_cache_restore.outputs.cache-hit != 'true' }}
168168
id: libxml_cache_save
169-
uses: actions/cache/save@v4
169+
uses: actions/cache/save@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
170170
with:
171171
path: "libxml2-${{ steps.libxml_patch_version.outputs.PATCH }}"
172172
key: ${{ steps.libxml_cache_restore.outputs.cache-primary-key }}
@@ -197,7 +197,7 @@ jobs:
197197
# yamllint enable rule:line-length
198198
199199
- name: Install PHP
200-
uses: shivammathur/setup-php@v2
200+
uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f # 2.35.5
201201
with:
202202
php-version: ${{ matrix.php }}
203203
ini-values: ${{ steps.set_ini.outputs.PHP_INI }}
@@ -209,7 +209,7 @@ jobs:
209209
# This action also handles the caching of the dependencies.
210210
- name: Set up node
211211
if: ${{ matrix.custom_ini == false }}
212-
uses: actions/setup-node@v5
212+
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
213213
with:
214214
node-version: '20'
215215

@@ -224,7 +224,7 @@ jobs:
224224
# Install dependencies and handle caching in one go.
225225
# @link https://github.com/marketplace/actions/install-php-dependencies-with-composer
226226
- name: Install Composer dependencies
227-
uses: "ramsey/composer-install@v3"
227+
uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # 3.1.1
228228
with:
229229
composer-options: ${{ matrix.php == '8.5' && '--ignore-platform-req=php+' || '' }}
230230
custom-cache-suffix: $(date -u "+%Y-%m")
@@ -257,7 +257,7 @@ jobs:
257257

258258
- name: Download the PHPCS phar
259259
if: ${{ matrix.custom_ini == false }}
260-
uses: actions/download-artifact@v5
260+
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
261261
with:
262262
name: phpcs-phar
263263

@@ -302,7 +302,7 @@ jobs:
302302
run: git config --global core.autocrlf input
303303

304304
- name: Checkout code
305-
uses: actions/checkout@v5
305+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
306306

307307
- name: Setup ini config
308308
if: ${{ matrix.custom_ini == true && matrix.os != 'windows-latest' }}
@@ -313,7 +313,7 @@ jobs:
313313
echo 'PHP_INI=, date.timezone=Australia/Sydney, short_open_tag=On' >> "$GITHUB_OUTPUT"
314314
315315
- name: Install PHP
316-
uses: shivammathur/setup-php@v2
316+
uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f # 2.35.5
317317
with:
318318
php-version: ${{ matrix.php }}
319319
ini-values: error_reporting=-1, display_errors=On, display_startup_errors=On${{ steps.set_ini.outputs.PHP_INI }}
@@ -322,7 +322,7 @@ jobs:
322322
# This action also handles the caching of the dependencies.
323323
- name: Set up node
324324
if: ${{ matrix.custom_ini == false }}
325-
uses: actions/setup-node@v5
325+
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
326326
with:
327327
node-version: '20'
328328

@@ -337,7 +337,7 @@ jobs:
337337
# Install dependencies and handle caching in one go.
338338
# @link https://github.com/marketplace/actions/install-php-dependencies-with-composer
339339
- name: Install Composer dependencies
340-
uses: "ramsey/composer-install@v3"
340+
uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # 3.1.1
341341
with:
342342
# Bust the cache at least once a month - output format: YYYY-MM.
343343
custom-cache-suffix: $(date -u "+%Y-%m")
@@ -385,7 +385,7 @@ jobs:
385385
386386
- name: "Upload coverage results to Coveralls (normal run)"
387387
if: ${{ success() }}
388-
uses: coverallsapp/github-action@v2
388+
uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # v2.3.6
389389
with:
390390
format: clover
391391
file: build/logs/clover.xml
@@ -394,7 +394,7 @@ jobs:
394394

395395
- name: "Upload coverage results to Coveralls (CBF run)"
396396
if: ${{ matrix.os != 'windows-latest' && success() }}
397-
uses: coverallsapp/github-action@v2
397+
uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # v2.3.6
398398
with:
399399
format: clover
400400
file: build/logs/clover-cbf.xml
@@ -409,6 +409,6 @@ jobs:
409409

410410
steps:
411411
- name: Coveralls Finished
412-
uses: coverallsapp/github-action@v2
412+
uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # v2.3.6
413413
with:
414414
parallel-finished: true

‎.github/workflows/validate.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,10 @@ jobs:
2626

2727
steps:
2828
- name: Checkout code
29-
uses: actions/checkout@v5
29+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
3030

3131
- name: Install PHP
32-
uses: shivammathur/setup-php@v2
32+
uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f # 2.35.5
3333
with:
3434
php-version: 'latest'
3535
coverage: none
@@ -52,38 +52,38 @@ jobs:
5252

5353
steps:
5454
- name: Checkout code
55-
uses: actions/checkout@v5
55+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
5656

5757
# Validate the XSD file.
5858
- name: Validate XSD against schema
59-
uses: phpcsstandards/xmllint-validate@v1
59+
uses: phpcsstandards/xmllint-validate@0fd9c4a9046055f621fca4bbdccb8eab1fd59fdc # v1.0.1
6060
with:
6161
pattern: "phpcs.xsd"
6262
xsd-url: "https://www.w3.org/2012/04/XMLSchema.xsd"
6363

6464
# Validate the XML ruleset files.
6565
- name: Validate rulesets against schema
66-
uses: phpcsstandards/xmllint-validate@v1
66+
uses: phpcsstandards/xmllint-validate@0fd9c4a9046055f621fca4bbdccb8eab1fd59fdc # v1.0.1
6767
with:
6868
pattern: "./src/Standards/*/ruleset.xml"
6969
xsd-file: "phpcs.xsd"
7070

7171
# Validate the Documentation XML files.
7272
- name: Validate documentation XML
73-
uses: phpcsstandards/xmllint-validate@v1
73+
uses: phpcsstandards/xmllint-validate@0fd9c4a9046055f621fca4bbdccb8eab1fd59fdc # v1.0.1
7474
with:
7575
pattern: "./src/Standards/*/Docs/*/*Standard.xml"
7676
xsd-url: "https://phpcsstandards.github.io/PHPCSDevTools/phpcsdocs.xsd"
7777

7878
# Validate dev tool related XML files.
7979
- name: Validate Project PHPCS ruleset against schema
80-
uses: phpcsstandards/xmllint-validate@v1
80+
uses: phpcsstandards/xmllint-validate@0fd9c4a9046055f621fca4bbdccb8eab1fd59fdc # v1.0.1
8181
with:
8282
pattern: "phpcs.xml.dist"
8383
xsd-file: "phpcs.xsd"
8484

8585
- name: "Validate PHPUnit config for well-formedness"
86-
uses: phpcsstandards/xmllint-validate@v1
86+
uses: phpcsstandards/xmllint-validate@0fd9c4a9046055f621fca4bbdccb8eab1fd59fdc # v1.0.1
8787
with:
8888
pattern: "phpunit.xml.dist"
8989

@@ -99,7 +99,7 @@ jobs:
9999

100100
steps:
101101
- name: Checkout code
102-
uses: actions/checkout@v5
102+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
103103

104104
# Updating the lists can fail intermittently, typically after Microsoft has released a new package.
105105
# This should not be blocking for this job, so ignore any errors from this step.
@@ -113,7 +113,7 @@ jobs:
113113

114114
# Show XML violations inline in the file diff.
115115
- name: Enable showing XML issues inline
116-
uses: korelstar/xmllint-problem-matcher@v1
116+
uses: korelstar/xmllint-problem-matcher@1bd292d642ddf3d369d02aaa8b262834d61198c0 # v1.2.0
117117

118118
# Check the code-style consistency of the XML files.
119119
- name: Check XML code style
@@ -157,14 +157,14 @@ jobs:
157157

158158
steps:
159159
- name: Checkout code
160-
uses: actions/checkout@v5
160+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
161161

162162
- name: Set up problem matcher
163-
uses: lumaxis/shellcheck-problem-matchers@v2
163+
uses: lumaxis/shellcheck-problem-matchers@b02a1715a00c729b20eed3ebb7edf56fa9a433ba # v2.1.0
164164
with:
165165
format: gcc
166166

167167
- name: Run ShellCheck
168-
uses: ludeeus/[email protected]
168+
uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0
169169
with:
170170
format: gcc

0 commit comments

Comments
 (0)