ci: pin GitHub Actions to commit SHAs and add Dependabot - #50631
Conversation
|
TL;DR same as iptv-org/database#32941 |
|
@MHSanaei Could you please specify the reason for closing the PR? |
|
There is no reason to use a hash for the version; it's an unnecessary PR. If this is to be useful and mergeable, it should just update the version to the latest with a short tag like v7, v6, and so on. |
The description actually includes a section titled "Why pin to SHAs" and "Why Dependabot is required, not optional". |
Pin every action reference to the full commit SHA that its current tag already resolves to, with the version kept in a trailing comment. No action changes version as a result of this commit -- including actions/setup-node in validate_issue.yml, which stays on v4.4.0 rather than being lifted to the v6 used by the other workflows. Version bumps are left to Dependabot so they arrive as reviewable PRs. Add .github/dependabot.yml for the github-actions ecosystem: weekly on Monday, minor/patch grouped into a single PR (majors always get their own), "ci" commit prefix. tibdex/github-app-token is ignored to match iptv-org-database; it is archived upstream, so replacing it should be a considered migration rather than an automated bump.
5ca4bfe to
4ed2a1f
Compare
There was a problem hiding this comment.
🟢 Approval recommended
The changes are low-risk and security-improving, with only minor non-functional formatting follow-ups suggested for Dependabot version comments.
Pull request overview
This PR hardens the repository’s GitHub Actions supply chain by making all workflow action references immutable (pinning to full commit SHAs) and adding Dependabot configuration to keep those pins updated over time.
Changes:
- Pin all GitHub Actions
uses:references in the existing workflows to full-length commit SHAs (with version comments). - Add
.github/dependabot.ymlto enable scheduled GitHub Actions dependency updates, grouping minor/patch updates and ignoringtibdex/github-app-token.
File summaries
| File | Description |
|---|---|
| .github/workflows/validate_label.yml | Pins actions/checkout and tibdex/github-app-token to SHAs. |
| .github/workflows/validate_issue.yml | Pins actions/checkout, tibdex/github-app-token, and actions/setup-node to SHAs. |
| .github/workflows/update.yml | Pins checkout, setup-node, tibdex/github-app-token, and deploy action to SHAs. |
| .github/workflows/format.yml | Pins checkout, setup-node, and tibdex/github-app-token to SHAs. |
| .github/workflows/check.yml | Pins checkout and setup-node to SHAs. |
| .github/dependabot.yml | Adds Dependabot updates for github-actions with grouping/ignore rules. |
Review details
Suppressed comments (1)
.github/workflows/update.yml:75
- Same as above: the version comment should use the
# vX.Y.Zform (currently# 4.1.1) so automated tooling can reliably update the comment when bumping the pinned SHA.
uses: JamesIves/github-pages-deploy-action@164583b9e44b4fc5910e78feb607ea7c98d3c7b9 # 4.1.1
- Files reviewed: 6/6 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
@MHSanaei This PR does not contain any actual changes to the version currently used. Once PR is merged and dependabot runs, dependabot will open PRs for each major bump to the ci and run ci independently. It'll be safer to bump versions one by one. For minor and patch updates, dependabot will group the changes to prevent PR spam. As for tibdex/github-app-token, I've seen how the migration to actions/create-github-app-token didn't go well in iptv-org/database, I've prepared a separate PR after dependabot is merged jogerj/iptv-org-database#1. It seems that there were some misconfiguration in the previous attempt. |
What this does
Pins all 17 action references across the five workflows to full-length commit SHAs, and adds
.github/dependabot.ymlto keep those pins current.No action changes version. Every SHA is the one its own reference already resolves to, verified against
git ls-remote. That includesactions/setup-nodeinvalidate_issue.yml, which stays on v4.4.0 rather than being quietly lifted to the v6 the other workflows use. This PR is a no-op at runtime; it only changes how the references are expressed.Why pin to SHAs
Tags are mutable.
@v6is a pointer that the action's maintainer — or anyone who compromises their repo — can move at any time, and the next workflow run silently executes different code.This is not hypothetical. In March 2025,
tj-actions/changed-fileswas compromised (CVE-2025-30066): the attacker retroactively repointed every tag fromv1throughv45.0.7at a malicious commit that dumped CI/CD secrets into workflow logs. Roughly 23,000 repositories were affected, and CISA issued an alert. Repos pinned to a SHA were unaffected, because a SHA cannot be repointed. Repos on floating tags were compromised without changing a line of their own code.GitHub's security hardening guide is unambiguous:
Why it matters specifically here
Four of the five workflows —
format.yml,update.yml,validate_issue.yml,validate_label.yml— mint a GitHub App token fromsecrets.APP_PRIVATE_KEY.update.ymlthen uses that token to deploy into two external repositories:iptv-org/iptv(gh-pages) andiptv-org/api(gh-pages).Worth being precise about one thing: every workflow here correctly declares least-privilege
permissions: contents: read. That hardening does not cover this case. Those permissions scope theGITHUB_TOKEN; they place no limit on an app token minted inside the job. Any action step running alongside it can read the app private key from the environment and obtain write access to both downstream repos. Thecontents: readline is good practice, but it is not the control that would stop atj-actions-style compromise here.Three of the four actions in use are third-party, and
tibdex/github-app-token— the one holding the private key in all four workflows — is archived upstream and receives no further fixes, security or otherwise.Why Dependabot is required, not optional
SHA pinning on its own is a security regression over time. It freezes you on a specific commit, so upstream fixes never arrive. Pinning without automation trades a live risk for a slow one.
The current state of this repo shows how that decay happens even with floating tags:
actions/checkoutactions/setup-nodeactions/setup-nodetibdex/github-app-tokenJamesIves/github-pages-deploy-actionThe
setup-nodesplit is the clearest symptom:validate_issue.ymlsits on v4.4.0 while the other three call sites moved to v6. Nothing flagged the divergence, because nothing was watching.JamesIves/github-pages-deploy-actionhas likewise sat on 4.1.1 through eight minor releases, in the job that deploys to two external repos.Dependabot turns pinning from a one-time cleanup that rots into a maintained baseline: it opens a PR when an action moves, updates both the SHA and its version comment, and a human decides whether to merge.
Deliberately, this PR does not bump any of those versions. Each is a reviewable decision, and Dependabot will raise them individually.
Cost: none
Dependabot does not consume Actions minutes. From GitHub's Dependabot runner documentation:
The only exception is larger runners, which this config does not use. This repository is public, where standard runners are free regardless. There is no billing impact.
Config
Weekly on Monday. Minor and patch updates are grouped into a single PR; major bumps are never grouped and always arrive individually, so the riskier upgrades stay reviewable one at a time.
tibdex/github-app-tokenis ignored. Because it is archived, replacing it is a migration decision — most likely toactions/create-github-app-token— rather than something to take as an automated version bump. Note the trade-off: with the ignore in place, Dependabot will stay quiet about those four call sites, so the migration needs to be tracked separately.