Repository navigation
ci: pin the Docker Hub and CLA actions and scope every workflow token - #5680
Open
Totara-thib wants to merge 3 commits into
Open
Totara-thib wants to merge 3 commits into
Totara-thib wants to merge 3 commits into
Conversation
Tags on third-party actions can be moved by whoever controls the action repository, and the next run then executes that code with this repo's credentials: the Docker Hub token in docker-publish, and the repo-scoped CLA personal access token that cla.yml hands to a floating beta tag under pull_request_target. Each action now points at the commit its current tag resolves to today, so nothing changes in behavior. The tag stays in a trailing comment and can be checked with git ls-remote. Dependabot understands this format and bumps the SHA and the comment together if version updates are ever enabled for github-actions. First-party actions (actions/*, github/*) stay on their tags.
Nine workflows had no permissions block, so their GITHUB_TOKEN got whatever the repository default grants, including the Docker Hub publish job and the pull_request_target CLA job. The scopes below come from what each job actually calls: - build, docker publish and validation, discovery smoke and the portal e2e runs only read the tree, they get contents: read. - commit lint lists the PR commits, it gets pull-requests: read. - the CLA job comments on and locks the PR and reads its own run history with the workflow token (signatures and re-runs go through the CLA PAT), so it keeps actions: read and pull-requests: write. - license-eye posts review comments when a header check fails, so the license job keeps pull-requests: write.
actions/checkout writes the workflow token into .git/config by default and leaves it there for every later step, including the Maven builds, the Docker image builds and the release packaging that runs with contents: write. None of these workflows pushes through git: the release upload authenticates gh with GH_TOKEN and the OpenAPI check only fetches the public base branch, so all 14 checkouts can set persist-credentials: false.
|
CLA Assistant Lite bot All contributors have signed the CLA ✍️ ✅ |
Contributor
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (14)
Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review. 📝 WalkthroughWalkthroughThe workflows restrict token permissions where specified, disable checkout credential persistence, and pin selected third-party actions to commit SHAs. ChangesWorkflow hardening
Estimated code review effort: 2 (Simple) | ~12 minutes Suggested reviewers: Merge Risk: ⚪ Minimal · up to The workflow changes narrow token access, disable checkout credential persistence, and pin selected actions. No concrete behavior or security regression is evident, so the PR appears ready for normal checks. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Author
|
I have read the CLA Document and I hereby sign the CLA |
Author
|
recheck |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What's the purpose of this PR
Pins the third-party actions to commit SHAs, scopes the workflow token per job, and stops checkouts from keeping the token. One commit each, no change in what the workflows do.
A tag like
docker/login-action@v2can be repointed by whoever controls the action repo, and the next run picks up the new code. That is how tj-actions/changed-files leaked CI secrets in March 2025 (CVE-2025-30066). The sharpest case here iscla.yml: it runs onpull_request_targetand hands the repo-scoped CLA token tocla-assistant/github-action@v2.1.2-beta, a floating beta tag of an action that is now archived upstream. The Docker Hub token that pushes the apollo images sits behind tags too.git ls-remote.permissions:block. Most jobs now only read, and the CLA and license jobs keeppull-requests: writesince they comment on PRs.persist-credentials: falseon all checkouts, nothing pushes through git.First-party actions keep their tags, pinning those too would help an OpenSSF Scorecard score. There is no Dependabot config here, if you add one for github-actions it bumps the SHA and the comment together.
If your org restricts allowed actions with tag patterns like
owner/action@v1, those stop matching SHAs.owner/action@*fixes it.Unrelated, but
commit_lint.ymltriggers on PRs tomainwhile the default branch ismaster, so it never runs.Which issue(s) this PR fixes:
None, this is a CI hardening change.
Brief changelog
Follow this checklist to help us incorporate your contribution quickly and easily:
mvn clean testto make sure this pull request doesn't break anything.mvn spotless:applyto format your code.CHANGESlog. (I'll add the entry once this PR has a number)Found and fixed by Plumber's analysis, reviewed and submitted by me.
Summary by CodeRabbit