Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Actions should be pinnable #95

Closed
zkoppert opened this issue Apr 15, 2024 · 2 comments
Closed

Actions should be pinnable #95

zkoppert opened this issue Apr 15, 2024 · 2 comments
Assignees
@jmeridth
Labels
enhancement New feature or request

Comments

@zkoppert
Copy link
Member

Is your feature request related to a problem?

Pinning using a cryptographic hash or signature is considered a Best Practice to ensure that a specific version of a component is used, which can help in making builds more reproducible and trustworthy. All of our GitHub OSPO Actions do not follow the best practices in terms of being immutable ("pinnable").

Related OSPO Tool

stale-repos GitHub Action, issues-metrics GitHub Action, automatic-contrib-prs GitHub Action, evergreen GitHub Action, cleanowners GitHub Action, contributors GitHub Action

Describe the solution you'd like

See remediation paths at https://github.com/boostsecurityio/poutine/blob/main/docs/content/en/rules/unpinnable_action.md#remediation

Ideally we would make our actions pinnable, update our docs to encourage that practice, and ensure our CI components are all pinned.

Describe alternatives you've considered

none

Additional context

Found based on running the poutine tool
@zkoppert zkoppert added the enhancement New feature or request label Apr 15, 2024
@jmeridth
Copy link
Member

jmeridth commented May 3, 2024

Turned on OSSF Scorecard on stale-repos and the results agree with this issue. 😄 Will work through them all in a PR per repo.

This was referenced May 4, 2024
Merged
Draft
jmeridth added a commit to github/stale-repos that referenced this issue May 6, 2024
@jmeridth
chore: change last few github actions to use shas
55a1ced 
Part of github/github-ospo#95

Fix up the last few GitHub Actions uses with SHAs instead of tags

Signed-off-by: jmeridth <[email protected]>
@jmeridth jmeridth mentioned this issue May 6, 2024
Merged
5 tasks
jmeridth added a commit to github/cleanowners that referenced this issue May 7, 2024
@jmeridth
chore: add OSSF scorecard github action and README badge
0df6bee 
Relates to github/github-ospo#84
Relates to github/github-ospo#95

- [x] setup OSSF scorecard github action
- [x] setup OSSF scorecard readme badge
- [x] change current GitHub Actions to use SHAs instead of tags

Signed-off-by: jmeridth <[email protected]>
jmeridth added a commit to github/cleanowners that referenced this issue May 7, 2024
@jmeridth
chore: add OSSF scorecard github action and README badge
53e5604 
Relates to github/github-ospo#84
Relates to github/github-ospo#95

- [x] setup OSSF scorecard github action
- [x] setup OSSF scorecard readme badge
- [x] change current GitHub Actions to use SHAs instead of tags

Signed-off-by: jmeridth <[email protected]>
@jmeridth jmeridth mentioned this issue May 7, 2024
Merged
7 tasks
jmeridth added a commit to github/contributors that referenced this issue May 7, 2024
@jmeridth
chore: add OSSF scorecard github action and README badge
a07c4d9 
Relates to github/github-ospo#84
Relates to github/github-ospo#95

- [x] setup OSSF scorecard github action
- [x] setup OSSF scorecard readme badge
- [x] change current GitHub Actions to use SHAs instead of tags

Signed-off-by: jmeridth <[email protected]>
@jmeridth jmeridth mentioned this issue May 7, 2024
Merged
7 tasks
jmeridth added a commit to github/contributors that referenced this issue May 7, 2024
@jmeridth
chore: add OSSF scorecard github action and README badge
69c9bd6 
Relates to github/github-ospo#84
Relates to github/github-ospo#95

- [x] setup OSSF scorecard github action
- [x] setup OSSF scorecard readme badge
- [x] change current GitHub Actions to use SHAs instead of tags

Signed-off-by: jmeridth <[email protected]>
jmeridth added a commit to github/automatic-contrib-prs that referenced this issue May 7, 2024
@jmeridth
chore: add OSSF scorecard github action and README badge
19d41d7 
Relates to github/github-ospo#84
Relates to github/github-ospo#95

- [x] setup OSSF scorecard github action
- [x] setup OSSF scorecard readme badge
- [x] change current GitHub Actions to use SHAs instead of tags

Signed-off-by: jmeridth <[email protected]>
@jmeridth jmeridth mentioned this issue May 7, 2024
Merged
7 tasks
jmeridth added a commit to github/evergreen that referenced this issue May 7, 2024
@jmeridth
chore: add OSSF scorecard github action and README badge
3d0feba 
Relates to github/github-ospo#84
Relates to github/github-ospo#95

- [x] setup OSSF scorecard github action
- [x] setup OSSF scorecard readme badge
- [x] change current GitHub Actions to use SHAs instead of tags

Signed-off-by: jmeridth <[email protected]>
@jmeridth jmeridth mentioned this issue May 7, 2024
Merged
7 tasks
jmeridth added a commit to github/issue-metrics that referenced this issue May 7, 2024
@jmeridth
chore: add OSSF scorecard github action and README badge
3970c61 
Relates to github/github-ospo#84
Relates to github/github-ospo#95

- [x] setup OSSF scorecard github action
- [x] setup OSSF scorecard readme badge
- [x] change current GitHub Actions to use SHAs instead of tags

Signed-off-by: jmeridth <[email protected]>
@jmeridth jmeridth mentioned this issue May 7, 2024
Merged
7 tasks
@jmeridth jmeridth self-assigned this May 7, 2024
jmeridth added a commit to github/issue-metrics that referenced this issue May 7, 2024
@jmeridth
chore: add OSSF scorecard github action and README badge
a8bf01d 
Relates to github/github-ospo#84
Relates to github/github-ospo#95

- [x] setup OSSF scorecard github action
- [x] setup OSSF scorecard readme badge
- [x] change current GitHub Actions to use SHAs instead of tags

Signed-off-by: jmeridth <[email protected]>
@jmeridth
Copy link
Member

jmeridth commented May 7, 2024

This is complete

@jmeridth jmeridth closed this as completed May 7, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jmeridth jmeridth

Labels
enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@jmeridth @zkoppert