diff options
| author | Yuriy Andamasov <yuriy@vyos.io> | 2026-05-28 13:25:43 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-05-28 13:25:43 +0300 |
| commit | b28c9e64fbfb91767e88cbefacd58e211c10d19e (patch) | |
| tree | 1ee0e8ed61b86c4e076660b11f762d1173ef6026 | |
| parent | 8f0fbf4d6081bb140b9a3c4656826317501aff5e (diff) | |
| download | vyos-github-actions-b28c9e64fbfb91767e88cbefacd58e211c10d19e.tar.gz vyos-github-actions-b28c9e64fbfb91767e88cbefacd58e211c10d19e.zip | |
ci(security): pin uses: refs to commit SHAs in auto-author-assign.yml (#11)
Addresses CodeRabbit finding on PR #10 (merged) — pin all three
movable refs in the pull_request_target workflow to immutable commit
SHAs. Defense in depth: the assign_reviewer job mints a vyos-bot[bot]
App-installation token from secrets.APP_PRIVATE_KEY; movable refs in a
secrets-handling pull_request_target workflow are an RCE vector if any
of the referenced repos (or any user with push access to them) is
compromised.
Pinned refs:
- toshimaru/auto-author-assign@2daaeb2 (was @v1.6.2)
- vyos/.github/.github/actions/get-token@8a437c7 (was @current — vyos
org-local but elevated trust workflow, so pin even our own action;
trade-off: must manually bump SHA on central-action updates)
- shufo/auto-assign-reviewer-by-files@f5f3db9 (was @v1.1.4)
CR thread: https://github.com/vyos/vyos-github-actions/pull/10#discussion_r3316105021
Phase 0 CR: 0 finding(s).
Refs: T8615 follow-up (the original CI-fix PR #10 was out-of-T8615-
scope but landed in the same sweep)
Generated by robots https://vyos.io
| -rw-r--r-- | .github/workflows/auto-author-assign.yml | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/.github/workflows/auto-author-assign.yml b/.github/workflows/auto-author-assign.yml index ef45294..77021dd 100644 --- a/.github/workflows/auto-author-assign.yml +++ b/.github/workflows/auto-author-assign.yml @@ -12,7 +12,7 @@ jobs: runs-on: ubuntu-latest steps: - name: "Assign Author to PR" - uses: toshimaru/auto-author-assign@v1.6.2 + uses: toshimaru/auto-author-assign@2daaeb2988aef24bf37e636fe733f365c046aba0 # v1.6.2 with: repo-token: ${{ secrets.GITHUB_TOKEN }} @@ -36,7 +36,7 @@ jobs: steps: - name: Mint vyos-bot installation token id: token - uses: vyos/.github/.github/actions/get-token@current + uses: vyos/.github/.github/actions/get-token@8a437c7bd8ef6f682f87a428f50e24832a0d316d # current branch HEAD as of 2026-05-28 with: owner: vyos client-id: ${{ vars.APP_CLIENT_ID }} @@ -48,7 +48,7 @@ jobs: # the downstream action is ever compromised. permissions: '{"pull_requests":"write"}' - name: Request review based on files changes and/or groups the author belongs to - uses: shufo/auto-assign-reviewer-by-files@v1.1.4 + uses: shufo/auto-assign-reviewer-by-files@f5f3db9ef06bd72ab6978996988c6462cbdaabf6 # v1.1.4 with: token: ${{ steps.token.outputs.token }} config: .github/reviewers.yml |