3 ms·
We forked the actions as a submodule, and then pointed the uses to that directory. That way we were still tracking the individual commits which we approved as
by OptionOfT 1y ago
We forked the actions as a submodule, and then pointed the uses to that directory.
That way we were still tracking the individual commits which we approved as a team.
Now there is interesting dichotomy. On one hand PMs want us to leverage GitHub Actions to build out stuff more quickly using pre-built blocks, but on the other hand security has no capacity or interest to whitelist actions (not to mention that the whitelist list is limited to 100 actions as per the article).
That said, even tagging GitHub actions with a sha256 isn't perfect for container actions as they can refer to a tag, and the contents of that tag can be changed: https://docs.github.com/en/actions/sharing-automations/creating-actions/metadata-syntax-for-github-actions#runs-for-docker-container-actions https://docs.github.com/en/actions/sharing-automations/creat...
E.g. I publish an action with code like
runs:
using: 'docker'
image: 'docker://optionoft/actions-tool:v3.0.0'
You use the action, and pin it to the SHA of this commit.
I get hacked, and a hacker publishes a new version of optionoft/actions-tool:v3.0.0
You wouldn't even get a Dependabot update PR.
- opello 1y agoMaybe there's a future Dependabot feature to create FYI issues when in use tags change?
- wereHamster 1y agosecurityscorecard is easy to integrate (it's a cli tool or you run it as a github action), one of the checks it performs is "Pinned-Dependencies": https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies https://github.com/ossf/scorecard/blob/main/docs/checks.md#p.... Checks that fail generate an security alert under Security -> Code scanning.
- OptionOfT 1y agoIs it transitive? > The check works by looking for unpinned dependencies in Dockerfiles, shell scripts, and GitHub workflows which are used during the build and release process of a project. Does it detect an unpinned (eg a Docker tag) of a pinned dependency.
- danudey 1y agoYou can sign images, and then theoretically validate those signatures; if an image changes it no longer matches the signature. Optionally, you can tell your action to reference the docker image by sha256 hash also, in which case it's effectively immutable.