Pin Forgejo Actions by commit SHA #45

New issue

Closed

opened 2026-06-14 19:24:40 +00:00 by james · 0 comments

james commented

2026-06-14 19:24:40 +00:00

Owner

Git tags on third-party actions are mutable refs — a compromised maintainer can re-point a tag at a malicious commit and every workflow that uses @v6.0.3 silently picks it up on the next run. Pinning by commit SHA freezes the action at the snapshot we reviewed.

Scope

Rewrite every uses: owner/name@vX.Y.Z line in .forgejo/workflows/*.yml to uses: owner/name@<full-40-char-sha> # vX.Y.Z. The tag stays in a trailing comment for human readability.
Cover both first-party (actions/checkout, actions/setup-node) and any third-party actions we adopt later.
Document the convention so future workflow edits stay SHA-pinned. The natural home is a CI section in CLAUDE.md or a new docs/ci.md.
Renovate (#44) keeps the SHAs fresh once it lands; this ticket is the one-time backfill.

Acceptance criteria

No uses: line in .forgejo/workflows/ references a mutable tag without a SHA pin.
PR pipeline still passes against the SHA-pinned actions.
The convention is documented and the docs link to the rationale (mutable-tag risk).

Part of epic #2.

Git tags on third-party actions are mutable refs — a compromised maintainer can re-point a tag at a malicious commit and every workflow that uses `@v6.0.3` silently picks it up on the next run. Pinning by commit SHA freezes the action at the snapshot we reviewed. ## Scope - Rewrite every `uses: owner/name@vX.Y.Z` line in `.forgejo/workflows/*.yml` to `uses: owner/name@<full-40-char-sha> # vX.Y.Z`. The tag stays in a trailing comment for human readability. - Cover both first-party (`actions/checkout`, `actions/setup-node`) and any third-party actions we adopt later. - Document the convention so future workflow edits stay SHA-pinned. The natural home is a CI section in `CLAUDE.md` or a new `docs/ci.md`. - Renovate (#44) keeps the SHAs fresh once it lands; this ticket is the one-time backfill. ## Acceptance criteria - [ ] No `uses:` line in `.forgejo/workflows/` references a mutable tag without a SHA pin. - [ ] PR pipeline still passes against the SHA-pinned actions. - [ ] The convention is documented and the docs link to the rationale (mutable-tag risk). Part of epic #2.

james referenced this issue

2026-06-14 19:25:19 +00:00

Run npm ci --ignore-scripts in CI with an explicit allowlist #46

james referenced this issue

2026-06-14 19:26:01 +00:00

Tag-driven service container release #16

james added the

area:ci

label

2026-06-14 19:26:35 +00:00

james referenced this issue from a commit

2026-06-15 11:59:44 +00:00