4 ms·
Public service announcement You can pin actions versions to their hash. Some might say this is a best practice for now. It looks like this, where the comment s
by imglorp 7mo ago
Public service announcement
You can pin actions versions to their hash. Some might say this is a best practice for now. It looks like this, where the comment says where the hash is supposed to point.
Old --> uses: actions/checkout@v4
New --> uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
There is a tool to sweep through your repo and automate this: https://github.com/mheap/pin-github-action https://github.com/mheap/pin-github-action
- lijok 7mo agoThe problem is actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 probably doesn’t do this same pinning, and the actions ecosystem is such an intertwined mess that any single compromised action can propagate to the rest
- imglorp 7mo agoYes, true, but at least the fire won't spread through this one point. Hopefully all of your upstreams can be persuaded to pin also.
- franktankbank 7mo agoDoesn't a single compromised action in the chain cause the whole to be fucked? Pinning the top level doesn't prevent any spread.
- teaearlgraycold 7mo agoMight want to vendor everything?
- franktankbank 7mo agoI don't know what this means in this context.
- teaearlgraycold 7mo agoMake copies of the entire GitHub action dependency tree.
- lijok 7mo agoThat’s the way to go indeed. We’ve done it, not difficult, just a bit of gruntwork to keep them updated when needed
- derfniw 7mo agoWell, it is a git commit hash of the action repo that contains the transpiled/bundled javascript. Like: https://github.com/actions/checkout/tree/11bd71901bbe5b1630ceea73d27597364c9af683/dist https://github.com/actions/checkout/tree/11bd71901bbe5b1630c... So I'm pretty sure that for the same commit hash, I'll be executing the same content.
- hobofan 7mo agoThis is true specifically for actions/checkout, but composite actions can have other actions as dependencies, and unless the composite action pins the versions of its dependencies, it is vulnerable for this attack. This article[0] gives a good overview of the challenges, and also has a link to a concrete attack where this was exploited. [0]: https://nesbitt.io/2025/12/06/github-actions-package-manager.html https://nesbitt.io/2025/12/06/github-actions-package-manager...
- kanzure 7mo agoI've always been worried about their backend changing and somehow named tags with a previous commit hash working for an attacker to give something you didn't expect for the commit hash.
- woodruffw 7mo agoSee also pinact[1], gha-update[2], and zizmor's unpinned-uses[3]. The main desiderata with these kinds of action pinning tools is that they (1) leave a tag comment, (2) leave that comment in a format that Dependabot and/or Renovate understands for bumping purposes, and (3) actually put the full tag in the comment, rather than the cutesy short tag that GitHub encourages people to make mutable (v4.x.y instead of v4). [1]: https://github.com/suzuki-shunsuke/pinact https://github.com/suzuki-shunsuke/pinact [2]: https://github.com/davidism/gha-update https://github.com/davidism/gha-update [3]: https://docs.zizmor.sh/audits/#unpinned-uses https://docs.zizmor.sh/audits/#unpinned-uses
- silverwind 7mo agoThis won't pin the action's dependencies, so it's a shallow approach only.
- rtaylorgarlock 7mo agoMy preferred tool to solve these issues is called 'gitlab'
- righthand 7mo agoCircleCI TravisCI Jenkins scripts dir Etc
- b00ty4breakfast 7mo agoyeah, github's business model is not really a git repository but a bunch of other (admittedly useful) stuff that traps people in their ecosystem.
- saxonww 7mo agoDoes it solve anything? I don't see this as a GitHub problem, it's a "we built a dependency management system with untrusted publishers" problem. GitLab's `include` feature has the same concern. They do offer an integrity check, but it's not any more capable than hash pinning to a commit. Fundamentally, if you offer a way to extend your product with externally-provided components, and you can't control the external publishers, then you've left the door open to 'these issues'.
- stefan_ 7mo agoCheckout v4 of course, released in August 2025, which already now pollutes my CI status with garbage warnings about some Node version being deprecated I could absolutely care less about. I swear half the problems of GitHub are because half that organization has some braindead obsession with upgrading everything everywhere all the time, delivering such great early slop experiments as "dependabot".
- OJFord 7mo ago> There is a tool to sweep through your repo and automate this: [third-party] Dependabot, too.