Update github actions (main) (minor) #235
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -29,4 +29,4 @@ jobs: | |
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Label PR by size | ||
| uses: conforma/pr-size-label-action@v1.2.0 | ||
|
There was a problem hiding this comment. [low] security conforma/pr-size-label-action is referenced by mutable tag (@v1.2.0) without a commit hash pin. All other actions in this repository use hash pinning (e.g., @sha # vX.Y.Z). While the risk is lower for an internal org action, tag references can be force-pushed, and hash pinning is a supply-chain security best practice. This is a pre-existing condition not introduced by this PR. Suggested fix: Pin to the commit hash: conforma/pr-size-label-action@9bff907 # v1.2.0 There was a problem hiding this comment. [low] security Action conforma/pr-size-label-action is pinned by mutable tag (@v1.2.0) rather than commit SHA. This workflow uses pull_request_target trigger with write permissions, where SHA pinning provides stronger supply-chain integrity. This is a pre-existing pattern (was @v1.0.0), not introduced by this PR. Suggested fix: Pin conforma/pr-size-label-action to a specific commit SHA (e.g., conforma/pr-size-label-action@9bff907 # v1.2.0) to match the pinning convention used in other workflows. There was a problem hiding this comment. [low] supply-chain/mutable-action-ref The action conforma/pr-size-label-action@v1.2.0 is pinned by a mutable tag rather than an immutable commit SHA. A compromised or force-pushed tag could substitute arbitrary code. This is especially relevant because the workflow triggers on pull_request_target with write permissions to pull-requests and issues. Suggested fix: Pin the action to a full commit SHA, e.g. conforma/pr-size-label-action@ # v1.2.0. Add a hash comment for readability, consistent with other workflows in this repo. There was a problem hiding this comment. [low] dependency pinning The conforma/pr-size-label-action dependency is pinned by mutable tag (v1.2.0) rather than by immutable SHA hash. All other actions in this repository use SHA pinning. This is a first-party action (owned by the conforma organization), which reduces the supply chain risk compared to a third-party dependency. The pattern is pre-existing and this PR merely bumps the version. Suggested fix: Pin conforma/pr-size-label-action by SHA hash with a version comment, consistent with the pinning strategy used for all other actions in this repository. For example: uses: conforma/pr-size-label-action@ # v1.2.0 There was a problem hiding this comment. [low] supply-chain Action conforma/pr-size-label-action is pinned to a mutable git tag (v1.2.0) rather than a commit SHA. A tag can be force-pushed, allowing the action contents to change without the workflow file changing. This is a pre-existing condition (was v1.0.0 before), but the version bump is an opportunity to pin to a SHA. Risk is partially mitigated by the action being owned by the same organization (conforma). Suggested fix: Pin to the full commit SHA for v1.2.0, e.g.: uses: conforma/pr-size-label-action@ # v1.2.0 |
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[low] supply-chain
conforma/pr-size-label-action is referenced by mutable tag (@v1.2.0) without a SHA pin, inconsistent with the repo convention of SHA-pinning all actions. This is a pre-existing issue not introduced by this PR.
Suggested fix: Pin the action to its commit SHA with a version comment, e.g., conforma/pr-size-label-action@ # v1.2.0. Configure Renovate pinDigests to automate this.