Skip to content

Commit 6ebf45c

Browse files
Peter Henggelerclaude
authored and
Peter Henggeler
committed
Pin all GitHub Actions to SHA refs for supply chain security
Replaces mutable version tags (e.g., @v4) with immutable SHA commit references across all 3 workflow files (build.yml, release.yml, test.yml). This prevents tag-moving supply chain attacks where a compromised maintainer or attacker could point a mutable tag at malicious code (as seen in the xygeni/xygeni-action and tj-actions/changed-files incidents). Original version tags are preserved as inline comments for readability. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent f7758ab commit 6ebf45c

File tree

3 files changed

+37
-37
lines changed

3 files changed

+37
-37
lines changed

‎.github/workflows/build.yml‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -28,11 +28,11 @@ jobs:
2828
platform: linux/arm64
2929
runs-on: ${{ matrix.runner }}
3030
steps:
31-
- uses: actions/checkout@v4
31+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
3232
- name: setup docker buildx
33-
uses: docker/setup-buildx-action@v3
33+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
3434
- name: cache for linux
35-
uses: actions/cache@v4
35+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
3636
if: runner.os == 'Linux'
3737
with:
3838
path: |
@@ -42,7 +42,7 @@ jobs:
4242
restore-keys: |
4343
${{ runner.os }}-go-${{matrix.asset_name}}-
4444
- name: cache for macOS
45-
uses: actions/cache@v3
45+
uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3
4646
if: runner.os == 'macOS'
4747
with:
4848
path: |
@@ -51,13 +51,13 @@ jobs:
5151
key: ${{ runner.os }}-go-${{matrix.asset_name}}-${{ hashFiles('**/go.sum') }}
5252
restore-keys: |
5353
${{ runner.os }}-go-${{matrix.asset_name}}
54-
- uses: docker/login-action@v3
54+
- uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
5555
with:
5656
registry: ${{ env.REGISTRY }}
5757
username: ${{ github.actor }}
5858
password: ${{ secrets.GITHUB_TOKEN }}
5959

60-
- uses: docker/build-push-action@v6
60+
- uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
6161
name: Build and push by digest
6262
id: build
6363
with:
@@ -75,7 +75,7 @@ jobs:
7575
touch "${{ runner.temp }}/digests/${digest#sha256:}"
7676
7777
- name: Upload digest
78-
uses: actions/upload-artifact@v4
78+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
7979
with:
8080
name: digests-${{ matrix.asset_name }}
8181
path: ${{ runner.temp }}/digests/*
@@ -93,24 +93,24 @@ jobs:
9393
packages: write
9494
steps:
9595
- name: Download digests
96-
uses: actions/download-artifact@v4
96+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
9797
with:
9898
path: ${{ runner.temp }}/digests
9999
pattern: digests-*
100100
merge-multiple: true
101101

102102
- name: Set up Docker Buildx
103-
uses: docker/setup-buildx-action@v3
103+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
104104

105-
- uses: docker/login-action@v2
105+
- uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2
106106
with:
107107
registry: ${{ env.REGISTRY }}
108108
username: ${{ github.actor }}
109109
password: ${{ secrets.GITHUB_TOKEN }}
110110

111111
- name: Docker meta
112112
id: meta
113-
uses: docker/metadata-action@v5
113+
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
114114
with:
115115
images: ${{ env.REGISTRY_IMAGE }}
116116
tags: |

‎.github/workflows/release.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -21,19 +21,19 @@ jobs:
2121

2222
steps:
2323
- name: checkout
24-
uses: actions/checkout@v4
24+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
2525
- name: setup Go ${{ matrix.go-version }}
26-
uses: actions/setup-go@v4
26+
uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4
2727
with:
2828
go-version: ${{ matrix.go-version }}
2929
cache: true
3030
- name: extract version from tags
3131
id: meta
3232
run: |
3333
echo ::set-output name=VERSION::${GITHUB_REF#refs/tags/}
34-
- uses: rui314/setup-mold@v1
34+
- uses: rui314/setup-mold@725a8794d15fc7563f59595bd9556495c0564878 # v1
3535
- name: cache for linux
36-
uses: actions/cache@v3
36+
uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3
3737
if: runner.os == 'Linux'
3838
with:
3939
path: |
@@ -43,7 +43,7 @@ jobs:
4343
restore-keys: |
4444
${{ runner.os }}-go-
4545
- name: cache for macOS
46-
uses: actions/cache@v3
46+
uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3
4747
if: runner.os == 'macOS'
4848
with:
4949
path: |
@@ -57,7 +57,7 @@ jobs:
5757
env:
5858
VERSION: ${{ steps.meta.outputs.VERSION }}
5959
- name: Upload binaries to release
60-
uses: svenstaro/upload-release-action@v2
60+
uses: svenstaro/upload-release-action@b98a3b12e86552593f3e4e577ca8a62aa2f3f22b # v2
6161
with:
6262
repo_token: ${{ secrets.GITHUB_TOKEN }}
6363
file: ${{ matrix.artifact_name }}

‎.github/workflows/test.yml‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,14 @@ jobs:
1414
runs-on: ${{ matrix.os }}
1515
steps:
1616
- name: checkout
17-
uses: actions/checkout@v4
17+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
1818
- name: setup Go ${{ matrix.go-version }}
19-
uses: actions/setup-go@v4
19+
uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4
2020
with:
2121
go-version: ${{ matrix.go-version }}
2222
cache: true
2323
- name: cache for linux
24-
uses: actions/cache@v3
24+
uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3
2525
if: runner.os == 'Linux'
2626
with:
2727
path: |
@@ -31,7 +31,7 @@ jobs:
3131
restore-keys: |
3232
${{ runner.os }}-go-
3333
- name: cache for macOS
34-
uses: actions/cache@v3
34+
uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3
3535
if: runner.os == 'macOS'
3636
with:
3737
path: |
@@ -43,7 +43,7 @@ jobs:
4343
- name: download modules
4444
run: |
4545
go mod download
46-
- uses: rui314/setup-mold@v1
46+
- uses: rui314/setup-mold@725a8794d15fc7563f59595bd9556495c0564878 # v1
4747
- name: build
4848
run: make emulator/build
4949
env:
@@ -67,13 +67,13 @@ jobs:
6767
runs-on: ${{ matrix.os }}
6868
steps:
6969
- name: setup Go ${{ matrix.go-version }}
70-
uses: actions/setup-go@v2
70+
uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 # v2
7171
with:
7272
go-version: ${{ matrix.go-version }}
7373
- name: checkout
74-
uses: actions/checkout@v4
74+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
7575
- name: cache for linux
76-
uses: actions/cache@v3
76+
uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3
7777
if: runner.os == 'Linux'
7878
with:
7979
path: |
@@ -83,7 +83,7 @@ jobs:
8383
restore-keys: |
8484
${{ runner.os }}-go-
8585
- name: cache for macOS
86-
uses: actions/cache@v3
86+
uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3
8787
if: runner.os == 'macOS'
8888
with:
8989
path: |
@@ -107,25 +107,25 @@ jobs:
107107
runs-on: ubuntu-latest
108108
steps:
109109
- name: checkout
110-
uses: actions/checkout@v4
110+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
111111
- name: setup docker buildx
112-
uses: docker/setup-buildx-action@v3
112+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
113113
- name: build docker image
114-
uses: docker/build-push-action@v6
114+
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
115115
with:
116116
context: .
117117
load: true
118118
tags: bigquery-emulator:test
119119
platforms: linux/amd64
120120
push: false
121121
- name: setup python
122-
uses: actions/setup-python@v5
122+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
123123
with:
124124
python-version-file: test/python/.python-version
125125
- name: install uv
126-
uses: astral-sh/setup-uv@v5
126+
uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
127127
- name: cache uv dependencies
128-
uses: actions/cache@v4
128+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
129129
with:
130130
path: ~/.cache/uv
131131
key: ${{ runner.os }}-uv-${{ hashFiles('test/python/uv.lock') }}
@@ -147,25 +147,25 @@ jobs:
147147
runs-on: ubuntu-latest
148148
steps:
149149
- name: checkout
150-
uses: actions/checkout@v4
150+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
151151
- name: setup docker buildx
152-
uses: docker/setup-buildx-action@v3
152+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
153153
- name: build docker image
154-
uses: docker/build-push-action@v6
154+
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
155155
with:
156156
context: .
157157
load: true
158158
tags: bigquery-emulator:test
159159
platforms: linux/amd64
160160
push: false
161161
- name: setup node
162-
uses: actions/setup-node@v4
162+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
163163
with:
164164
node-version: '24'
165165
- name: enable corepack
166166
run: corepack enable
167167
- name: cache yarn dependencies
168-
uses: actions/cache@v4
168+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
169169
with:
170170
path: test/node/.yarn/cache
171171
key: ${{ runner.os }}-yarn-${{ hashFiles('test/node/yarn.lock') }}

0 commit comments

Comments
 (0)
⚡