From 8a7a43d86e26411801027703356a6daad4635f0e Mon Sep 17 00:00:00 2001 From: kobihikri Date: Tue, 14 Jul 2026 10:56:31 +0300 Subject: [PATCH] security: pin kubescape/github-action to a full commit SHA MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Docker Image Scanners workflow logs in to ghcr.io with GITHUB_TOKEN before running the image scanners, so any action in this job runs with a credentialed Docker session. kubescape/github-action is still referenced by the mutable `@main` branch, which means the exact code that runs in that credentialed context can change without any change to this template. This is the same hardening applied to trivy-action in #247 (after master briefly pointed to a malicious version, CVE-2026-33634). Pinning to a full commit SHA closes the same class of risk for kubescape. 7d90c1f159f02df1e3c79f839eeabe42ea30d4e3 is the commit `@main` resolves to today (2026-06-01), so behaviour is unchanged — the ref is just fixed in place. Regenerating the downstream repos propagates the pin to kratos, hydra, keto and the other server repos. --- templates/repository/server/.github/workflows/cve-scan.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/repository/server/.github/workflows/cve-scan.yaml b/templates/repository/server/.github/workflows/cve-scan.yaml index 7853390..9dc931c 100644 --- a/templates/repository/server/.github/workflows/cve-scan.yaml +++ b/templates/repository/server/.github/workflows/cve-scan.yaml @@ -82,7 +82,7 @@ jobs: with: sarif_file: ${{ steps.grype-scan.outputs.sarif }} - name: Kubescape scanner - uses: kubescape/github-action@main + uses: kubescape/github-action@7d90c1f159f02df1e3c79f839eeabe42ea30d4e3 # pins @main as of 2026-06-01 id: kubescape with: image: ${{ env.IMAGE_NAME }}