Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Pin github workflow dependencies by hash #16579

Closed
laurentsimon opened this issue May 19, 2021 · 0 comments · Fixed by #16581
Closed

Pin github workflow dependencies by hash #16579

laurentsimon opened this issue May 19, 2021 · 0 comments · Fixed by #16581
Assignees
@asraa
Labels
enhancement Feature requests. Not bugs or questions. tech debt

Comments

@laurentsimon
Copy link

If you are reporting any crash or any potential security issue, do not
open an issue in this repo. Please report the issue via emailing
[email protected] where the issue will be triaged appropriately.

Title: Reduce attack surface by pinning github workflow dependencies by hash

Description:
scorecard reports:

!! frozen-deps - .github/workflows/codeql-daily.yml has non-pinned dependency 'actions/checkout@v2' (job "CodeQL-Build")
!! frozen-deps - .github/workflows/codeql-daily.yml has non-pinned dependency 'github/codeql-action/init@v1' (job "CodeQL-Build")
!! frozen-deps - .github/workflows/codeql-daily.yml has non-pinned dependency 'github/codeql-action/analyze@v1' (job "CodeQL-Build")
!! frozen-deps - .github/workflows/codeql-push.yml has non-pinned dependency 'actions/checkout@v2' (job "CodeQL-Build")
!! frozen-deps - .github/workflows/codeql-push.yml has non-pinned dependency 'github/codeql-action/init@v1' (job "CodeQL-Build")
!! frozen-deps - .github/workflows/codeql-push.yml has non-pinned dependency 'github/codeql-action/analyze@v1' (job "CodeQL-Build")

Fix:
Pi all dependencies by hash. Examples can be found here
@laurentsimon laurentsimon added bug triage Issue requires triage labels May 19, 2021
@asraa asraa self-assigned this May 19, 2021
@asraa asraa mentioned this issue May 19, 2021
Merged
@alyssawilk alyssawilk added enhancement Feature requests. Not bugs or questions. tech debt and removed triage Issue requires triage bug labels May 24, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@asraa asraa

Labels
enhancement Feature requests. Not bugs or questions. tech debt
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[ci] Pin CodeQL workflow dependencies by hash asraa/envoy
3 participants
@asraa @alyssawilk @laurentsimon