Problem
All GitHub Actions in .github/workflows/ci.yaml are referenced by mutable tags
(e.g. actions/checkout@v5). If a tag is silently moved to a malicious commit,
arbitrary code runs in our CI pipeline with id-token: write and packages: write
permissions.
Ref: GitHub security hardening guide — Using third-party actions
Changes
Replace each tag reference with the full commit SHA of the latest release, and
keep the version as an inline comment:
| Action |
Current |
Latest |
actions/checkout |
@v5 |
@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 |
docker/setup-qemu-action |
@v3 |
@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0 |
docker/setup-buildx-action |
@v3 |
@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 |
docker/login-action |
@v3 |
@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 |
docker/metadata-action |
@v5 |
@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0 |
docker/build-push-action |
@v6 |
@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 |
Problem
All GitHub Actions in
.github/workflows/ci.yamlare referenced by mutable tags(e.g.
actions/checkout@v5). If a tag is silently moved to a malicious commit,arbitrary code runs in our CI pipeline with
id-token: writeandpackages: writepermissions.
Ref: GitHub security hardening guide — Using third-party actions
Changes
Replace each tag reference with the full commit SHA of the latest release, and
keep the version as an inline comment:
actions/checkout@v5@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0docker/setup-qemu-action@v3@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0docker/setup-buildx-action@v3@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0docker/login-action@v3@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0docker/metadata-action@v5@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0docker/build-push-action@v6@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0