From 46c64e0b3a1f14185da49ff08606f7c0d112c0d8 Mon Sep 17 00:00:00 2001 From: OssSecurityBot Date: Fri, 10 Jul 2026 10:29:04 -0400 Subject: [PATCH 1/2] Pin GitHub Actions to full-length commit SHAs --- .github/actions/setup/action.yml | 6 ++--- .github/dependabot.yml | 2 ++ .github/workflows/codeql.yml | 2 +- .github/workflows/main.yml | 28 ++++++++++++------------ .github/workflows/nightly.yml | 10 ++++----- .github/workflows/publish-gh-release.yml | 2 +- 6 files changed, 26 insertions(+), 24 deletions(-) diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml index 336c41658..bee9d7cf9 100644 --- a/.github/actions/setup/action.yml +++ b/.github/actions/setup/action.yml @@ -94,13 +94,13 @@ runs: - name: Start Sccache if: inputs.enable-sccache == 'true' && !(runner.os == 'Windows' && runner.arch == 'ARM64') - uses: mozilla-actions/sccache-action@v0.0.10 + uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 with: version: ${{ env.SCCACHE_VERSION }} - name: Install Rust if: inputs.rust-toolchain != '' - uses: actions-rust-lang/setup-rust-toolchain@v1.16.1 + uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1 with: toolchain: ${{ steps.expand.outputs.toolchain }} components: ${{ inputs.rust-components }} @@ -113,4 +113,4 @@ runs: - name: Install Wild Linker if: inputs.enable-wild-linker == 'true' - uses: wild-linker/action@0.9.0 + uses: wild-linker/action@0bbbfa5df4380cab8e63cb8505a1ce65e1d10203 # 0.9.0 diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 7487fb314..57346f8d0 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -21,3 +21,5 @@ updates: directory: "/" schedule: interval: "monthly" + cooldown: + default-days: 7 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b6a25a2d5..42b794d12 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -57,7 +57,7 @@ jobs: # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages steps: - name: Checkout repository - uses: actions/checkout@v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 # Add any setup steps before running the `github/codeql-action/init` action. # This includes steps like installing compilers or runtimes (`actions/setup-node` diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 056a410ad..fa48fae40 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -24,7 +24,7 @@ jobs: skip: ${{ steps.compute.outputs.skip }} steps: - name: Checkout - uses: actions/checkout@v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 - name: Setup @@ -101,7 +101,7 @@ jobs: steps: # prep - name: Checkout - uses: actions/checkout@v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Setup uses: ./.github/actions/setup with: @@ -141,7 +141,7 @@ jobs: steps: # prep - name: Checkout - uses: actions/checkout@v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Setup uses: ./.github/actions/setup with: @@ -184,7 +184,7 @@ jobs: steps: # prep - name: Checkout - uses: actions/checkout@v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 1 - name: Setup @@ -216,7 +216,7 @@ jobs: steps: # prep - name: Checkout - uses: actions/checkout@v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 - name: Setup @@ -278,7 +278,7 @@ jobs: steps: # prep - name: Checkout - uses: actions/checkout@v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Setup uses: ./.github/actions/setup with: @@ -315,7 +315,7 @@ jobs: steps: # prep - name: Checkout - uses: actions/checkout@v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Setup uses: ./.github/actions/setup with: @@ -335,7 +335,7 @@ jobs: steps: # prep - name: Checkout - uses: actions/checkout@v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Setup uses: ./.github/actions/setup with: @@ -354,7 +354,7 @@ jobs: steps: # prep - name: Checkout - uses: actions/checkout@v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 - name: Setup @@ -395,7 +395,7 @@ jobs: steps: # prep - name: Checkout - uses: actions/checkout@v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Setup uses: ./.github/actions/setup with: @@ -421,7 +421,7 @@ jobs: if: github.event_name == 'pull_request' steps: - name: Check PR Title - uses: amannn/action-semantic-pull-request@v6.1.1 + uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -445,7 +445,7 @@ jobs: runs-on: ubuntu-slim steps: - name: Checkout - uses: actions/checkout@v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 1 - name: Setup @@ -468,7 +468,7 @@ jobs: steps: # prep - name: Checkout - uses: actions/checkout@v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Setup uses: ./.github/actions/setup with: @@ -495,7 +495,7 @@ jobs: steps: # prep - name: Checkout - uses: actions/checkout@v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Setup # The synthetic-workspace fixture builder shells out to `cargo metadata`, # so Rust must be available even though no Rust code is compiled. diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 011c107bf..fd0a60379 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -15,7 +15,7 @@ jobs: outputs: should_skip: ${{ steps.check.outputs.should_skip }} steps: - - uses: actions/checkout@v7.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 @@ -38,7 +38,7 @@ jobs: steps: # prep - name: Checkout - uses: actions/checkout@v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Setup uses: ./.github/actions/setup with: @@ -67,7 +67,7 @@ jobs: steps: # prep - name: Checkout - uses: actions/checkout@v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Setup uses: ./.github/actions/setup with: @@ -118,7 +118,7 @@ jobs: steps: # prep - name: Checkout - uses: actions/checkout@v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Setup uses: ./.github/actions/setup with: @@ -141,7 +141,7 @@ jobs: steps: # prep - name: Checkout - uses: actions/checkout@v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Setup uses: ./.github/actions/setup with: diff --git a/.github/workflows/publish-gh-release.yml b/.github/workflows/publish-gh-release.yml index d6f92bbc0..2f35b7b50 100644 --- a/.github/workflows/publish-gh-release.yml +++ b/.github/workflows/publish-gh-release.yml @@ -26,7 +26,7 @@ jobs: runs-on: ubuntu-slim steps: - name: Checkout - uses: actions/checkout@v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Setup uses: ./.github/actions/setup From 2a368dd88dcace65a27748a32f6923b3fa36c5e6 Mon Sep 17 00:00:00 2001 From: Vaiz <4908982+Vaiz@users.noreply.github.com> Date: Tue, 14 Jul 2026 05:46:13 +0100 Subject: [PATCH 2/2] docs: document immutable-release exceptions and cooldown rationale - Add code comments next to codecov/codecov-action, github/codeql-action (init+analyze), and taiki-e/install-action noting these are intentionally left tag-pinned because their releases are immutable (verified via the GitHub API 'immutable: true' field), so a SHA pin adds no extra supply-chain protection. - Clarify the dependabot.yml cooldown comment: the 7-day cooldown gives security researchers time to detect/report a compromised Action release before Dependabot proposes it, not to group updates. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/actions/setup/action.yml | 4 ++++ .github/dependabot.yml | 3 +++ .github/workflows/codeql.yml | 5 +++++ .github/workflows/main.yml | 5 +++++ 4 files changed, 17 insertions(+) diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml index bee9d7cf9..a1457e4b6 100644 --- a/.github/actions/setup/action.yml +++ b/.github/actions/setup/action.yml @@ -107,6 +107,10 @@ runs: - name: Install Cargo Tools if: inputs.cargo-tools != '' + # taiki-e/install-action publishes immutable GitHub releases (verified via the GitHub API: + # "immutable": true on GET /repos/taiki-e/install-action/releases/tags/v2.81.8). The tag + # cannot be retargeted, so this reference is intentionally left unpinned to a commit SHA. + # See https://github.com/taiki-e/install-action/releases/tag/v2.81.8 uses: taiki-e/install-action@v2.81.8 with: tool: ${{ steps.expand.outputs.cargo_tools }} diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 57346f8d0..19953b4f8 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -21,5 +21,8 @@ updates: directory: "/" schedule: interval: "monthly" + # 7-day cooldown before Dependabot proposes a newly published Action version. This gives + # the community/security researchers a window to detect and report a compromised or + # "poisoned" release before it's automatically pulled into this repo. cooldown: default-days: 7 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 42b794d12..02b4740b9 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -66,6 +66,10 @@ jobs: # uses: actions/setup-example@v1 # Initializes the CodeQL tools for scanning. + # github/codeql-action publishes immutable GitHub releases (verified via the GitHub API: + # "immutable": true on GET /repos/github/codeql-action/releases/tags/v4.36.2). The tag cannot + # be retargeted, so init/analyze below are intentionally left pinned to the tag, not a SHA. + # See https://github.com/github/codeql-action/releases/tag/v4.36.2 - name: Initialize CodeQL uses: github/codeql-action/init@v4.36.2 with: @@ -95,6 +99,7 @@ jobs: echo ' make release' exit 1 + # See the immutable-release note above (github/codeql-action) — same tag, same rationale. - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@v4.36.2 with: diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index fa48fae40..f7a85c32a 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -410,6 +410,11 @@ jobs: - name: Generate Coverage (no-default-features) run: cargo +${{ env.RUST_NIGHTLY }} llvm-cov --no-default-features --workspace --lcov --output-path lcov-no-def.info - name: Upload Coverage to Codecov + # codecov/codecov-action publishes immutable GitHub releases (verified via the GitHub API: + # "immutable": true on GET /repos/codecov/codecov-action/releases/tags/v7.0.0). An immutable + # release's tag can never be retargeted to a different commit, so pinning to a SHA adds no + # extra protection here; this reference is intentionally left as a tag. + # See https://github.com/codecov/codecov-action/releases/tag/v7.0.0 uses: codecov/codecov-action@v7.0.0 with: token: ${{ secrets.CODECOV_TOKEN }}