From b28c9e64fbfb91767e88cbefacd58e211c10d19e Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Thu, 28 May 2026 13:25:43 +0300 Subject: ci(security): pin uses: refs to commit SHAs in auto-author-assign.yml (#11) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Addresses CodeRabbit finding on PR #10 (merged) — pin all three movable refs in the pull_request_target workflow to immutable commit SHAs. Defense in depth: the assign_reviewer job mints a vyos-bot[bot] App-installation token from secrets.APP_PRIVATE_KEY; movable refs in a secrets-handling pull_request_target workflow are an RCE vector if any of the referenced repos (or any user with push access to them) is compromised. Pinned refs: - toshimaru/auto-author-assign@2daaeb2 (was @v1.6.2) - vyos/.github/.github/actions/get-token@8a437c7 (was @current — vyos org-local but elevated trust workflow, so pin even our own action; trade-off: must manually bump SHA on central-action updates) - shufo/auto-assign-reviewer-by-files@f5f3db9 (was @v1.1.4) CR thread: https://github.com/vyos/vyos-github-actions/pull/10#discussion_r3316105021 Phase 0 CR: 0 finding(s). Refs: T8615 follow-up (the original CI-fix PR #10 was out-of-T8615- scope but landed in the same sweep) Generated by robots https://vyos.io --- .github/workflows/auto-author-assign.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/auto-author-assign.yml b/.github/workflows/auto-author-assign.yml index ef45294..77021dd 100644 --- a/.github/workflows/auto-author-assign.yml +++ b/.github/workflows/auto-author-assign.yml @@ -12,7 +12,7 @@ jobs: runs-on: ubuntu-latest steps: - name: "Assign Author to PR" - uses: toshimaru/auto-author-assign@v1.6.2 + uses: toshimaru/auto-author-assign@2daaeb2988aef24bf37e636fe733f365c046aba0 # v1.6.2 with: repo-token: ${{ secrets.GITHUB_TOKEN }} @@ -36,7 +36,7 @@ jobs: steps: - name: Mint vyos-bot installation token id: token - uses: vyos/.github/.github/actions/get-token@current + uses: vyos/.github/.github/actions/get-token@8a437c7bd8ef6f682f87a428f50e24832a0d316d # current branch HEAD as of 2026-05-28 with: owner: vyos client-id: ${{ vars.APP_CLIENT_ID }} @@ -48,7 +48,7 @@ jobs: # the downstream action is ever compromised. permissions: '{"pull_requests":"write"}' - name: Request review based on files changes and/or groups the author belongs to - uses: shufo/auto-assign-reviewer-by-files@v1.1.4 + uses: shufo/auto-assign-reviewer-by-files@f5f3db9ef06bd72ab6978996988c6462cbdaabf6 # v1.1.4 with: token: ${{ steps.token.outputs.token }} config: .github/reviewers.yml -- cgit v1.2.3