From a596dd7e5fe5ca83255e660735ef0df6ff1360b2 Mon Sep 17 00:00:00 2001 From: XananasX7 Date: Sun, 28 Jun 2026 02:11:14 +0000 Subject: [PATCH] fix(security): pin GitHub Actions to commit SHAs in CI/publish workflows Mutable tag references (e.g. checkout@v2, setup-python@v1, pypa/gh-action-pypi-publish@v1.4.2, astral-sh/setup-uv@v5) can be silently redirected to malicious code. If a tag-pinned action runs in a job that holds PYPI_TOKEN the attacker can publish a backdoored release, poisoning every downstream user of this package. Pin all action references to their immutable commit SHA. The original tag is preserved as a comment for human readability. --- .github/workflows/pypi-nightly.yaml | 4 ++-- .github/workflows/pypi.yaml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/pypi-nightly.yaml b/.github/workflows/pypi-nightly.yaml index 0ed73de..7ebf727 100644 --- a/.github/workflows/pypi-nightly.yaml +++ b/.github/workflows/pypi-nightly.yaml @@ -13,9 +13,9 @@ jobs: deploy: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 - name: Set up Python - uses: actions/setup-python@v1 + uses: actions/setup-python@0f07f7f756721ebd886c2462646a35f78a8bc4de # v1 with: python-version: '3.x' - name: Install dependencies diff --git a/.github/workflows/pypi.yaml b/.github/workflows/pypi.yaml index 36af740..17ec3a6 100644 --- a/.github/workflows/pypi.yaml +++ b/.github/workflows/pypi.yaml @@ -11,9 +11,9 @@ jobs: deploy: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 - name: Set up Python - uses: actions/setup-python@v1 + uses: actions/setup-python@0f07f7f756721ebd886c2462646a35f78a8bc4de # v1 with: python-version: '3.x' - name: Install dependencies