ci: pin GitHub Actions to commit SHAs and add Dependabot - #32941
Conversation
|
TL;DR I added dependabot and pinned every action to SHA commit. Please check if the current configuration of dependabot is acceptable :) Oh, also when merged, we can enable "Require actions to be pinned to a full-length commit SHA" under https://github.com/iptv-org/database/settings/actions Next, on the issue of migrating to actions/create-github-app-token jogerj#1 |
freearhey
left a comment
freearhey
left a comment
There was a problem hiding this comment.
Please restore the CRLF line endings in all files.
Pin every action reference to the full commit SHA that its current tag already resolves to, with the version kept in a trailing comment. No action changes version as a result of this commit -- the pins are byte-equivalent to what the floating tags point at today. Version bumps are left to Dependabot so they arrive as reviewable PRs. Add .github/dependabot.yml for the github-actions ecosystem: weekly on Monday, minor/patch grouped into a single PR (majors always get their own), "ci" commit prefix. tibdex/github-app-token is ignored -- 7c77646 switched deploy.yml to actions/create-github-app-token@v2 and 5c2520c reverted it three days later, so that pin is deliberate.
|
@freearhey if line endings matter that much, please consider introducing a .gitattributes file to all repos. This saves time for all collaborators |
b212c56 to
ff9ce0f
Compare
|
@jogerj There had been previous attempts to use |
There was a problem hiding this comment.
🟢 Approval recommended
The changes are limited to immutable SHA pinning and a valid Dependabot configuration, with no behavioral logic changes to workflows.
Pull request overview
Pins GitHub Actions used in this repository’s CI workflows to immutable full-length commit SHAs and adds a Dependabot configuration to keep those pins updated over time, improving supply-chain security without changing runtime behavior.
Changes:
- Replace floating action tags (e.g.,
@v4) with full-length commit SHA pins across the existing workflows (keeping the same resolved versions via comments). - Add
.github/dependabot.ymlto checkgithub-actionsweekly and group minor/patch updates while leaving major updates ungrouped. - Configure Dependabot to ignore
tibdex/github-app-tokenupdates per the documented rationale.
File summaries
| File | Description |
|---|---|
| .github/workflows/validate_label.yml | Pin actions/checkout and actions/create-github-app-token to SHAs. |
| .github/workflows/validate_issue.yml | Pin actions/checkout, actions/create-github-app-token, and actions/setup-node to SHAs. |
| .github/workflows/update.yml | Pin action references (create-github-app-token, checkout, setup-node, check-crlf-extended) to SHAs. |
| .github/workflows/deploy.yml | Pin tibdex/github-app-token, checkout, setup-node, and github-pages-deploy-action to SHAs. |
| .github/workflows/check.yml | Pin actions/checkout, actions/setup-node, and check-crlf-extended to SHAs. |
| .github/dependabot.yml | Add weekly Dependabot updates for github-actions, grouping minor/patch updates and ignoring tibdex/github-app-token. |
Review details
- Files reviewed: 6/6 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
What this does
Pins all 18 action references across the five workflows to full-length commit SHAs, and adds
.github/dependabot.ymlto keep those pins current.No action changes version. Every SHA is the one its current tag already resolves to, verified against
git ls-remote. This PR is a no-op at runtime; it only changes how the references are expressed.Why pin to SHAs
Tags are mutable.
@v4is a pointer the action's maintainer — or anyone who compromises their repo — can move at any time, and your next workflow run silently executes different code.This is not hypothetical. In March 2025,
tj-actions/changed-fileswas compromised (CVE-2025-30066): the attacker retroactively repointed every tag fromv1throughv45.0.7at a malicious commit that dumped CI/CD secrets into workflow logs. Roughly 23,000 repositories were affected, and CISA issued an alert. Repos pinned to a SHA were unaffected, because a SHA cannot be repointed. Repos on floating tags were compromised without changing a line of their own code.GitHub's own security hardening guide is unambiguous:
Why it matters specifically here
This is not a repo where a compromised action would be a minor inconvenience:
deploy.ymlandupdate.ymlmint a GitHub App token fromsecrets.APP_PRIVATE_KEY.update.ymlruns withcontents: writeand pushes tomaster.deploy.ymlpushes to a second repository,iptv-org/api, using that app token.Any action step running in those jobs sits next to a GitHub App private key with write access to two repos. Four of the six actions used here are third-party, and two of them (
kforeverisback/check-crlf-extended,tibdex/github-app-token) are small, single-maintainer projects. That is precisely the profile thetj-actionsattacker exploited.Why Dependabot is required, not optional
SHA pinning on its own is a security regression over time. It freezes you on a specific commit, so upstream security fixes never arrive. Pinning without automation trades a live risk for a slow one.
The current state of this repo shows exactly how that decay happens even with floating tags:
actions/checkoutactions/setup-nodeactions/create-github-app-tokenkforeverisback/check-crlf-extendedtibdex/github-app-tokenJamesIves/github-pages-deploy-actionFive of six are a major version behind —
actions/checkoutandactions/setup-nodeby three majors.Deliberately, this PR does not bump any of those versions. Each one is a reviewable decision, and Dependabot will raise them individually as PRs so maintainers can take them at their own pace.
Cost: none
Dependabot does not consume Actions minutes. From GitHub's Dependabot runner documentation:
The only exception is larger runners, which this config does not use. This repository is public, where standard runners are free regardless. There is no billing impact.
Config
Weekly on Monday. Minor and patch updates are grouped into a single PR; major bumps are never grouped and always arrive individually, so the risky upgrades stay reviewable one at a time.
tibdex/github-app-tokenis ignored. That pin is intentional: 7c77646 switcheddeploy.ymltoactions/create-github-app-token@v2, and 5c2520c reverted it three days later. The ignore stops Dependabot from re-litigating a decision that was already made, and the reason is recorded inline so the next person doesn't undo it.