Skip to content

ci: unblock pinned-actions gate and pr title check #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
will-wang-opus wants to merge 3 commits into from
Closed

ci: unblock pinned-actions gate and pr title check #10

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f524c0c
ci: run actions-pinned-check via reusable workflow
will-wang-opus Aug 14, 2026
3eebff6
ci: consume shared gate via composite action on opus-runner-standard
will-wang-opus Aug 14, 2026
b59f1c4
ci: read pr title config from checkout, not the api
will-wang-opus Aug 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 11 additions & 22 deletions .github/workflows/actions-pinned-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,14 @@
---
# SEC-254: every `uses:` must reference an immutable 40-char commit SHA.
# Mutable tags/branches do not pin — a compromised maintainer token can repoint
# them at a malicious commit (CVE-2025-30066 hit 23k+ repos via tj-actions).
# Deliberately implemented with shell only: the gate itself must not add a
# third-party action dependency.
# SEC-254: every third-party `uses:` must reference an immutable 40-char commit
# SHA. Mutable tags/branches do not pin — a compromised maintainer token can
# repoint them at a malicious commit (CVE-2025-30066 hit 23k+ repos via
# tj-actions).
#
# Uses the shared iac gate via its composite action rather than the reusable-
# workflow caller. The job MUST stay on opus-runner-standard: only that runner's
# allow-listed IP can fetch the private opus-pro/iac action. A `workflow_call`
# caller can't set runs-on, and its control-plane resolution can't reach iac
# from this repo — hence the composite-action form here.
name: actions-pinned-check
on:
pull_request:
Expand All @@ -22,20 +27,4 @@ jobs:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
with:
persist-credentials: false
- name: Fail on unpinned action refs
run: |
set -euo pipefail
bad=$(grep -rnE '^[[:space:]]*(-[[:space:]]+)?uses:' .github \
--include='*.yml' --include='*.yaml' \
| sed 's/#.*//' \
| grep 'uses:' \
| grep -vE "uses:[[:space:]]*[\"']?\./" \
| grep -vE 'docker://[^[:space:]]+@sha256:' \
| grep -vE "@[0-9a-f]{40}[\"']?[[:space:]]*$" \
|| true)
if [ -n "$bad" ]; then
echo "Unpinned action references (must be 40-char commit SHAs):"
echo "$bad"
exit 1
fi
echo "All action references are SHA-pinned."
- uses: opus-pro/iac/.github/actions/actions-pinned-check@main
6 changes: 5 additions & 1 deletion .github/workflows/check-pr-basic.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,4 +22,8 @@ jobs:
- uses: thehanimo/pr-title-checker@1d8cd483a2b73118406a187f54dca8a9415f1375 # v1.4.2
with:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
configuration_path: pull_request_title.json
# Read the config off the checkout, not the contents API: the org's IP
# allow list rejects API calls from GitHub-hosted runners ("your IP
# address is not permitted"), which failed this gate on every PR.
# LABEL.name is empty, so this is the action's only API call.
local_configuration_path: pull_request_title.json
Loading