From 214629fa829f0f04909a0218874610ea6003558f Mon Sep 17 00:00:00 2001 From: Mark Shine Date: Sun, 30 Aug 2026 12:41:09 +0200 Subject: [PATCH] Pin every GitHub Action to a commit SHA MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A tag is a moving pointer: `actions/checkout@v4` is whatever the owner, or whoever takes the owner's account, last pointed v4 at. That matters more here than anywhere else in the estate. release.yml runs with `contents: write` and GITHUB_TOKEN to publish the binaries people install, so an action swapped underneath it does not just leak a build — it ships a backdoored CLI under our name to everyone who upgrades. All 6 references now pin the SHA the tag currently resolves to, with the version kept as a trailing comment so the file still reads and Renovate and Dependabot keep proposing bumps. No versions change. ci.yml also gains a top-level `permissions: contents: read`; it had none. release.yml already declared its own, and the two jobs that publish keep their `contents: write` — a job-level block replaces the default rather than adding to it. --- .github/workflows/ci.yml | 9 +++++++-- .github/workflows/release.yml | 8 ++++---- 2 files changed, 11 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 507d1e8..96db03b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -5,12 +5,17 @@ on: branches: [main] pull_request: +# CI needs nothing but source. The release workflow, which does need to write, +# declares that on the jobs that publish. +permissions: + contents: read + jobs: build-and-test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-go@v5 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: go-version-file: go.mod - name: Build diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7c2a29a..5941d60 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,7 +15,7 @@ jobs: contents: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Create release and publish the install script env: @@ -61,9 +61,9 @@ jobs: goos: darwin goarch: arm64 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: go-version-file: go.mod @@ -120,7 +120,7 @@ jobs: contents: read runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Render the formula env: