Skip to content

fix(ci): add missing version comments to SHA-pinned action refs

25d0bd0
Select commit
Loading
Failed to load commit list.
Merged

fix(ci): harden against template injection and credential exposure #2514

fix(ci): add missing version comments to SHA-pinned action refs
25d0bd0
Select commit
Loading
Failed to load commit list.
Chainguard Enforce / Enforce - Commit Signing succeeded May 5, 2026 in 1s

Successfully verified commit signature.

CLAIM DESCRIPTION
Found Git signature
Validated Git signature
Validated Rekor entry
Allowed by policy

Details

Certificate

Details
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 220552349816994846834702742178698191564348585312 (0x26a1e8cf2d17e8446745e5ca1fc9b073c773f560)
    Signature Algorithm: ECDSA-SHA384
        Issuer: O=sigstore.dev,CN=sigstore-intermediate
        Validity
            Not Before: May 5 04:18:20 2026 UTC
            Not After : May 5 04:28:20 2026 UTC
        Subject:         Subject Public Key Info:
            Public Key Algorithm: ECDSA
                Public-Key: (256 bit)
                X:
                    62:e6:27:bb:3c:d8:32:8a:d5:fd:70:a8:8b:a8:32:
                    72:75:9c:e1:7e:16:05:c5:53:1a:43:86:f9:d3:50:
                    c8:0a
                Y:
                    3d:7c:60:98:9f:46:25:1a:39:0e:a5:94:73:c3:e4:
                    c2:49:c2:1c:0e:bb:e7:24:7b:e6:c5:40:4e:5e:1f:
                    3d:be
                Curve: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Subject Key Identifier:
                31:56:D3:53:99:3E:33:E3:62:AE:A3:10:41:60:B5:43:43:A1:BF:50
            X509v3 Authority Key Identifier:
                keyid:DF:D3:E9:CF:56:24:11:96:F9:A8:D8:E9:28:55:A2:C6:2E:18:64:3F
            X509v3 Subject Alternative Name: critical
                email:steve.beattie@chainguard.dev
            oidcIssuer:
                https://accounts.google.com
            Unknown extension 1.3.6.1.4.1.57264.1.8
            Signed Certificate Timestamp:
                BHsAeQB3AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABnfZbvU4AAAQDAEgwRgIhAMvClZc0yGxBSEXgBcWw6iK07H1ryurrFzefPsBSrAf3AiEAgOTa/A3D+eO+sQWtd29GCCdpI10oy8/7I5FDguQzU+w=

    Signature Algorithm: ECDSA-SHA384
         30:65:02:31:00:9b:43:20:d0:66:d6:95:6a:7b:84:69:16:d6:
         40:32:65:b7:3e:77:c8:59:29:2d:84:9c:ff:ea:3d:6c:b6:ee:
         fa:29:92:f2:19:e3:d7:3e:38:64:3a:46:98:8a:a6:3f:23:02:
         30:05:2c:b3:04:2b:5b:ef:58:ca:3f:58:cb:b3:c8:71:f5:a7:
         ce:1e:81:a0:cf:8f:98:82:1a:fc:45:d7:bf:be:29:82:19:af:
         ec:4d:e0:b0:77:2b:4f:fa:7a:32:1e:05:5c

Rekor Entry

Details
{
  "body": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIyMmVmODBkZWU4NTBjOWFmY2RiODhlMjFlNTVjODlkYjFlZTBmOGRiMWFhN2M2M2ZlZGI2MGE4ODU3ODE3MmYyIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FUUNJSEpUZnc4QWJtVUFFMGFta0pMMGpnbWJ2V3BmVklGT3J2RTNHMXN3NHZSZEFpQkJTM0Y3Z0MrZUgxUld3TzlOamVURnRUVzNLK0pkVUcrVmRLajJxcVV1OWc9PSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTXhha05EUVd4NVowRjNTVUpCWjBsVlNuRkliM3A1TUZnMlJWSnVVbVZZUzBnNGJYZGpPR1I2T1ZkQmQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFpkMDVVUVRGTlJGRjRUMFJKZDFkb1kwNU5hbGwzVGxSQk1VMUVVWGxQUkVsM1YycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZaZFZsdWRYcDZXVTF2Y2xZdldFTnZhVFpuZVdOdVYyTTBXRFJYUW1OV1ZFZHJUMGNLSzJST1VYbEJiemxtUjBOWmJqQlpiRWRxYTA5d1dsSjZkeXRVUTFOalNXTkVjblp1U2toMmJYaFZRazlZYURnNWRuRlBRMEZZYzNkblowWXpUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZOVm1KVUNsVTFheXROSzA1cGNuRk5VVkZYUXpGUk1FOW9kakZCZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDB0bldVUldVakJTUVZGSUwwSkRRWGRJYjBWall6TlNiR1J0VlhWWmJWWm9aRWhTY0ZwVlFtcGhSMFp3WW0xa01WbFlTbXRNYlZKc1pHcEJjQXBDWjI5eVFtZEZSVUZaVHk5TlFVVkNRa0owYjJSSVVuZGplbTkyVERKR2Fsa3lPVEZpYmxKNlRHMWtkbUl5WkhOYVV6VnFZakl3ZDB0M1dVdExkMWxDQ2tKQlIwUjJla0ZDUTBGUlpFUkNkRzlrU0ZKM1kzcHZka3d5Um1wWk1qa3hZbTVTZWt4dFpIWmlNbVJ6V2xNMWFtSXlNSGRuV1hOSFEybHpSMEZSVVVJS01XNXJRMEpCU1VWbVVWSTNRVWhyUVdSM1JHUlFWRUp4ZUhOalVrMXRUVnBJYUhsYVducGpRMjlyY0dWMVRqUTRjbVlyU0dsdVMwRk1lVzUxYW1kQlFRcEJXak15VnpjeFQwRkJRVVZCZDBKSlRVVlpRMGxSUkV4M2NGZFlUazFvYzFGVmFFWTBRVmhHYzA5dmFYUlBlRGxoT0hKeE5uaGpNMjU2TjBGVmNYZElDamwzU1doQlNVUnJNblozVG5jdmJtcDJja1ZHY2xoa2RsSm5aMjVoVTA1a1MwMTJVQ3Q1VDFKUk5FeHJUVEZRYzAxQmIwZERRM0ZIVTAwME9VSkJUVVFLUVRKblFVMUhWVU5OVVVOaVVYbEVVVnAwWVZaaGJuVkZZVkppVjFGRVNteDBlalV6ZVVacmNFeFpVMk12SzI4NVlreGlkU3RwYlZNNGFHNXFNWG8wTkFwYVJIQkhiVWx4YlZCNVRVTk5RVlZ6YzNkUmNsY3JPVmw1YWpsWmVUZFFTV05tVjI1NmFEWkNiMDByVUcxSlNXRXZSVmhZZGpjMGNHZG9iWFkzUlRObkNuTklZM0pVTDNBMlRXZzBSbGhCUFQwS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9fX19",
  "integratedTime": 1777954700,
  "logID": "c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d",
  "logIndex": 1439142788,
  "verification": {
    "inclusionProof": {
      "checkpoint": "rekor.sigstore.dev - 1193050959916656506\n1318196404\nZi7giiBaTsLe0sms3MhusqfBye6PdaZXKPsJeh2m6mE=\n\n— rekor.sigstore.dev wNI9ajBEAiAWAAaqf0d1Uunz8LyZ6Z5eYOXSkiRaY8JkeKBVJD3uAwIgEZrf5pMhmYSmWnwAv/ynYWJ3Qyhr/1WDuGQEggrGlss=\n",
      "hashes": [
        "6736137819dc8c6d41550936de0697ec7afc89c602b1b5302e6beebb88f36f5d",
        "9ee22bb0b58c4ea1beb1114c5f687692c71b931db09daf080db53292e76becd5",
        "68b5295d2cf734478ed8d3160fccc05b5b7390d44fe93313269a6b3d6ef03449",
        "08f661fac0358a0d8d4e8799e2bd798df33d7ff55df98bd768bfc0489c19b699",
        "277e9ee912eaa776fffe5c2f9504b9af9db3e3d4fffe785c696a8f5838f4abff",
        "10250c75e863060172b3a05df3a64fc589bdec03119fc9eb3ace2ba9212389d0",
        "cd994bd36416a671d153c712b06cad69181d14db1bde0faddebb91db4d5f0f1d",
        "219810b8847af4547f30295bcb88541dd4adde1059de6103adb6d6067833551b",
        "13ff96636e8721c3c58a6d3a9b6d89a644282c6b126c24e4d114c4db455c1e74",
        "3daeb1fda2bb60f4c55bac2c8a2a8e17b38a7131a7c2be6b778a217d38f79ae7",
        "fe606a80eb0ca87840c90382ac3cc5798e7f8a93541f3cee0b3363109a119046",
        "8c9f650b039061127c3d2f444fc0478063cd2cbd566ada93b04eca1fcb2607de",
        "e40f4254dd82387cfcdd3d01132411ab99524cb2e9340937af1776cb5fc41fbb",
        "6988a32f3722dcc97f66437b02c570536aacb36b868b94a773bcd3df80bb712c",
        "8958f05d1f615ee4396af3301d78f4f9c91044bf792a8d568f90ec7650d2c20a",
        "85b162259716c152ed6086f2445a6181f895a8d495f1ac565e4a3781ab35d018",
        "f87c475fc2b90a2e146061429b1330f61d16358ad48f89a53cc5f442384f29b2",
        "082222ea861293e787ab59941ca795fdd5a98aa6df38ad08d6d1cca2a091e58c",
        "a03fc2649f66c582ad1e094d15cf8a584a98615318cd63c9d18d7793cb3aa661",
        "13457e496013ddd0d2fc972e005133bea2eb8b04bc23ecf4b78126bfd08b4e06",
        "642aa589b787fac877011a8bdd66c9ea2440a111ddb13c934bea89fe741a89a6",
        "4c0c17b53a488166762e673c48446c3dc7bfe3e634343270c50103ff751d03f9",
        "31186bb55a2bfd47fe84a97284558e93ff7f4360b779d0b511a27efd55d27741",
        "c1ae56efdcca7323677155455f1f0f33cefce49fa7d14d2ac622b61972b3d879",
        "ef2db6fce76f9cd4c9de0cf3e7b5845ba0ff9a69ab2d75747554320f07a7c790",
        "0ce09ea12328bc8bcb13192122f8aca30f40b8d5e0796b3810293247a11ca985"
      ],
      "logIndex": 1317238526,
      "rootHash": "662ee08a205a4ec2ded2c9acdcc86eb2a7c1c9ee8f75a65728fb097a1da6ea61",
      "treeSize": 1318196404
    },
    "signedEntryTimestamp": "MEYCIQCSLzl3DU3wh1MW1P6AHZLhZVX1FVmXlKA42UrwirxrxwIhANyLlAyyXQw0t/H3swwxyiLIfxhrj9j8IbebpAhae3ut"
  }
}