build: add workflow to restrict GitHub Action SHA pin changes#11638
Draft
Planeshifter wants to merge 1 commit intodevelopfrom
Draft
build: add workflow to restrict GitHub Action SHA pin changes#11638Planeshifter wants to merge 1 commit intodevelopfrom
Planeshifter wants to merge 1 commit intodevelopfrom
Conversation
Adds `.github/workflows/check_workflow_action_pins.yml`, which fails a
pull request when a non-maintainer author adds or removes a pinned
`uses: <action>@<SHA>` line in any file under `.github/workflows/**`.
Trust is determined via `github.event.pull_request.author_association`
(OWNER/MEMBER/COLLABORATOR), with automatic passthrough for dependabot
and stdlib-bot. Maintainers may bypass the check by applying the
`Allow Action Pin Changes` label. On failure, stdlib-bot comments on
the pull request with the offending lines and unblocking instructions.
---
type: pre_commit_static_analysis_report
description: Results of running static analysis checks when committing changes.
report:
- task: lint_filenames
status: passed
- task: lint_editorconfig
status: passed
- task: lint_markdown
status: na
- task: lint_package_json
status: na
- task: lint_repl_help
status: na
- task: lint_javascript_src
status: na
- task: lint_javascript_cli
status: na
- task: lint_javascript_examples
status: na
- task: lint_javascript_tests
status: na
- task: lint_javascript_benchmarks
status: na
- task: lint_python
status: na
- task: lint_r
status: na
- task: lint_c_src
status: na
- task: lint_c_examples
status: na
- task: lint_c_benchmarks
status: na
- task: lint_c_tests_fixtures
status: na
- task: lint_shell
status: na
- task: lint_typescript_declarations
status: passed
- task: lint_typescript_tests
status: na
- task: lint_license_headers
status: passed
---
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This pull request:
.github/workflows/check_workflow_action_pins.yml, that prevents untrusted contributors from modifying pinned GitHub Action SHAs in any file under.github/workflows/**.github.event.pull_request.author_associationisOWNER,MEMBER, orCOLLABORATOR, and automatically passes the check fordependabot[bot]andstdlib-bot.Allow Action Pin Changeslabel, which causes the scan to be skipped and the check to pass on re-run.stdlib-boton the pull request listing the offending lines and explaining how to unblock — either by reverting the pin change or by requesting the bypass label.Why
Every workflow file in this repo pins actions to a full commit SHA (e.g.
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2). Those pins are a supply-chain safeguard — an attacker who compromises an upstream action does not affect this repo as long as the pinned SHA is unchanged. Today, nothing programmatically prevents a PR from silently swapping one pinned SHA for another that points at a compromised commit; review is the only backstop. This workflow makes that class of change impossible to merge without explicit maintainer approval.Design notes
pull_request_target(runs from the base branch) so the check cannot be disabled or weakened by edits to this workflow file in the PR itself. No PR code is checked out — only the GitHub API is queried — so the usualpull_request_targetpwn-request risk does not apply.GET /repos/{repo}/pulls/{n}/files, matches added/removed lines against^[+-][[:space:]]*uses:[[:space:]]+[^@[:space:]]+@[0-9a-f]{7,40}in any file whose current or previous path is under.github/workflows/**. Rename-out evasion is covered viaprevious_filename.curlverifies HTTP 200 and the response is a JSON array before iterating; rate-limit / 5xx errors fail loud instead of silently passing.peter-evans/find-comment+peter-evans/create-or-update-commentwith an HTML marker so repeated failures update a single comment instead of stacking.Out of scope / known gaps
@[0-9a-f]{7,40}). An untrusted contributor could in principle adduses: foo/bar@v1(tag/branch reference) without tripping the check. This matches the stated scope (SHA pins only); code review remains the backstop for the repo's pin-only policy.Related Issues
No.
Questions
Allow Action Pin Changes(mirrors theDo Not Mergestyle). The label must be created in repo Settings → Labels before merging; any color works, but a light-green "approval" color reads well.secrets.STDLIB_BOT_GITHUB_TOKENfor the comment step (same ascheck_required_files.yml). Should it useSTDLIB_BOT_PAT_REPO_WRITEinstead for consistency withgenerate_pr_commit_message.yml?Other
End-to-end verification plan after merge:
run:change) on the same PR. Confirm the check passes.Allow Action Pin Changeslabel. Confirm the scan step is skipped and the check goes green; remove the label and confirm it fails again..github/workflows/<file>.ymlout of the directory still fails if it touches SHA lines.Checklist
AI Assistance
If you answered "yes" above, how did you use AI assistance?
Disclosure
This PR was authored with Claude Code. The workflow design, regex, trust model, and comment/label bypass were developed interactively with the assistant; I reviewed the final workflow and message copy before opening the PR.
@stdlib-js/reviewers