Repository navigation
ci: pin third-party release actions to commit SHAs - #87
Merged
Merged
Conversation
Mutable tags let an upstream compromise run untrusted code in a job that holds contents:write and id-token:write. Pin to the commits the v3 tags resolve to today so behavior is unchanged; Dependabot keeps the SHAs and version comments up to date. Resolves CodeQL actions/unpinned-tag alerts. Co-Authored-By: Claude Code - Claude Opus 5.5 (medium) <noreply@anthropic.com>
1 of 4 tasks
perezmlal
added a commit
that referenced
this pull request
Oct 13, 2026
Convert the [Unreleased] CHANGELOG block to [2.3.0] and fill the gaps: the project website, Event Publisher runtime dependency bumps, the nifi-scripts Poetry resolution fix (#65), release-action SHA pinning (#87) and Werkzeug 3.1.9. Mirror the summary in RELEASE.md with the upgrade note for the MQTT Sink connector setting. Move the website entry out of [2.1.0]: it was merged after v2.2.0 and is in neither the v2.1.0 nor the v2.2.0 tree. Restore the code fences in docs/Event-Publisher.md, which #83 indented far enough to render as literal text. Signed-off-by: Luis Alfredo Perez Medina <perezmlal@outlook.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Pins the two third-party actions in
.github/workflows/release.ymlto full commit SHAs. This resolves CodeQL code-scanning alertsactions/unpinned-tagforsoftprops/action-gh-release@v3(line 41) andsigstore/cosign-installer@v3(line 23).The release job runs with
contents: writeandid-token: write. With a mutable tag, a compromised upstream could change the code that runs while those permissions are active.sigstore/cosign-installer@v3@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1softprops/action-gh-release@v3@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3Each SHA is the commit that the upstream
v3tag points to today, read from the upstream repository's tags (not from a fork). The workflow runs exactly the same code as before.Type of change
Checklist
poetry run pytestpasses locally.ruff checkandbanditreport no new issues (see the Development guide).docs/,CHANGELOG.md).Notes for reviewers
uses:references in a workflow and touches no Python code.v3tag points to v3.9.1, not the newest v3 release (v3.10.1). I pinned v3.9.1 to keep behavior unchanged. Moving to v3.10.x or v4.x changes how signing works and belongs in a separate PR.github-actionsecosystem in.github/dependabot.ymlwill keep the SHAs and their# vX.Y.Zcomments updated.v*tag is pushed, so this PR's CI does not run it. The SHAs will first be used on the next release tag.