From 0c026700248c1f0478d39f6758a160a0dbd2634d Mon Sep 17 00:00:00 2001 From: Rich Megginson Date: Wed, 12 Aug 2026 17:08:26 -0600 Subject: [PATCH] ci: use commit hash for github action, add persist-credentials false [citest_skip] The latest security guidance is to use the full commit hash, which is immutable, instead of a tag or version, which can be mutable, for the reference to a version of a github action. There are known attacks which inserted unauthorized code in a version tag and moved the tag. This prevents this sort of attack, at the cost of more maintenance burden, but dependabot will largely take care of this for us. Each version or tag has been replaced with the corresponding commit hash - in some cases, this is not the latest commit on the main branch, so I would expect to see some dependabot updates in the near future. I thought it was safer to do it this way - preserve existing behavior/functionality - rather than replace and upgrade to a newer version at the same time. The coderabbit `Pin the Galaxy action's container image.` issue is tracked at https://github.com/robertdebock/galaxy-action/issues/16 This also adds `persist-credentials: false` to the actions/checkout tasks so that any credentials used by that task will not persist for subsequent tasks, for those workflows that do not need the credentials for subsequent tasks. Signed-off-by: Rich Megginson --- .github/workflows/ansible-lint.yml | 8 +++++--- .github/workflows/ansible-managed-var-comment.yml | 6 ++++-- .github/workflows/ansible-test.yml | 8 +++++--- .github/workflows/build_docs.yml | 6 +++--- .github/workflows/changelog_to_tag.yml | 10 ++++++---- .github/workflows/codeql.yml | 10 ++++++---- .github/workflows/codespell.yml | 6 ++++-- .github/workflows/markdownlint.yml | 4 +++- .github/workflows/pr-title-lint.yml | 3 ++- .github/workflows/python-unit-test.yml | 10 ++++++---- .github/workflows/qemu-kvm-integration-tests.yml | 12 +++++++----- .github/workflows/shellcheck.yml | 6 ++++-- .github/workflows/test_converting_readme.yml | 6 ++++-- .github/workflows/tft.yml | 15 +++++++++------ .github/workflows/weekly_ci.yml | 5 +++-- .github/workflows/woke.yml | 6 ++++-- 16 files changed, 75 insertions(+), 46 deletions(-) diff --git a/.github/workflows/ansible-lint.yml b/.github/workflows/ansible-lint.yml index 01e8824..8f95150 100644 --- a/.github/workflows/ansible-lint.yml +++ b/.github/workflows/ansible-lint.yml @@ -39,15 +39,17 @@ jobs: sudo apt install -y git - name: Checkout repo - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Install tox, tox-lsr run: | set -euxo pipefail - pip3 install "git+https://github.com/linux-system-roles/tox-lsr@3.20.1" + pip3 install "git+https://github.com/linux-system-roles/tox-lsr@d594be24ed56e586a5796720d51c261e40c20496" - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: python-version: ${{ matrix.versions.python }} diff --git a/.github/workflows/ansible-managed-var-comment.yml b/.github/workflows/ansible-managed-var-comment.yml index a2127cd..0a359d0 100644 --- a/.github/workflows/ansible-managed-var-comment.yml +++ b/.github/workflows/ansible-managed-var-comment.yml @@ -28,12 +28,14 @@ jobs: sudo apt install -y git - name: Checkout repo - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Install tox, tox-lsr run: | set -euxo pipefail - pip3 install "git+https://github.com/linux-system-roles/tox-lsr@3.20.1" + pip3 install "git+https://github.com/linux-system-roles/tox-lsr@d594be24ed56e586a5796720d51c261e40c20496" - name: Run ansible-plugin-scan run: | diff --git a/.github/workflows/ansible-test.yml b/.github/workflows/ansible-test.yml index 033d7e9..815e898 100644 --- a/.github/workflows/ansible-test.yml +++ b/.github/workflows/ansible-test.yml @@ -42,15 +42,17 @@ jobs: sudo apt install -y git - name: Checkout repo - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Install tox, tox-lsr run: | set -euxo pipefail - pip3 install "git+https://github.com/linux-system-roles/tox-lsr@3.20.1" + pip3 install "git+https://github.com/linux-system-roles/tox-lsr@d594be24ed56e586a5796720d51c261e40c20496" - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: python-version: ${{ matrix.versions.python }} diff --git a/.github/workflows/build_docs.yml b/.github/workflows/build_docs.yml index eac3504..6bf5403 100644 --- a/.github/workflows/build_docs.yml +++ b/.github/workflows/build_docs.yml @@ -25,7 +25,7 @@ jobs: sudo apt install -y git - name: Check out code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: fetch-depth: 0 - name: Ensure the docs branch @@ -48,12 +48,12 @@ jobs: fi - name: Checkout the docs branch - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: ref: docs - name: Fetch README.md and .pandoc_template.html5 template from the workflow branch - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: sparse-checkout: | README.md diff --git a/.github/workflows/changelog_to_tag.yml b/.github/workflows/changelog_to_tag.yml index 7918402..7585dea 100644 --- a/.github/workflows/changelog_to_tag.yml +++ b/.github/workflows/changelog_to_tag.yml @@ -22,7 +22,9 @@ jobs: sudo apt install -y git - name: checkout PR - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Get tag and message from the latest CHANGELOG.md commit id: tag @@ -69,7 +71,7 @@ jobs: echo "tagname=$_tagname" >> "$GITHUB_OUTPUT" echo "branch=$_branch" >> "$GITHUB_OUTPUT" - name: Create tag - uses: mathieudutour/github-tag-action@v6.2 + uses: mathieudutour/github-tag-action@a22cf08638b34d5badda920f9daf6e72c477b07b # v6.2 with: github_token: ${{ secrets.GITHUB_TOKEN }} custom_tag: ${{ steps.tag.outputs.tagname }} @@ -77,7 +79,7 @@ jobs: - name: Create Release id: create_release - uses: ncipollo/release-action@v1 + uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1 with: tag: ${{ steps.tag.outputs.tagname }} name: Version ${{ steps.tag.outputs.tagname }} @@ -85,7 +87,7 @@ jobs: makeLatest: true - name: Publish role to Galaxy - uses: robertdebock/galaxy-action@1.2.1 + uses: robertdebock/galaxy-action@7d89099e09f4385ec4b53eb58c0d120f1ad806dd # 1.2.1 with: galaxy_api_key: ${{ secrets.galaxy_api_key }} git_branch: ${{ steps.tag.outputs.branch }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 42ad52c..de98dc8 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -34,18 +34,20 @@ jobs: sudo apt update sudo apt install -y git - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@v4.37.4 + uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 with: languages: ${{ matrix.language }} queries: +security-and-quality - name: Autobuild - uses: github/codeql-action/autobuild@v4.37.4 + uses: github/codeql-action/autobuild@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.37.4 + uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml index 45c1913..c389f2a 100644 --- a/.github/workflows/codespell.yml +++ b/.github/workflows/codespell.yml @@ -13,7 +13,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Codespell - uses: codespell-project/actions-codespell@v2 + uses: codespell-project/actions-codespell@406322ec52dd7b488e48c1c4b82e2a8b3a1bf630 # v2 diff --git a/.github/workflows/markdownlint.yml b/.github/workflows/markdownlint.yml index 8956014..bc2ff07 100644 --- a/.github/workflows/markdownlint.yml +++ b/.github/workflows/markdownlint.yml @@ -28,7 +28,9 @@ jobs: sudo apt install -y git - name: Check out code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false # CHANGELOG.md is generated automatically from PR titles and descriptions # It might have issues but they are not critical diff --git a/.github/workflows/pr-title-lint.yml b/.github/workflows/pr-title-lint.yml index a1eeabc..d504e1c 100644 --- a/.github/workflows/pr-title-lint.yml +++ b/.github/workflows/pr-title-lint.yml @@ -18,8 +18,9 @@ jobs: commit-checks: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: + persist-credentials: false fetch-depth: 0 - name: Install pr_title_lint.py diff --git a/.github/workflows/python-unit-test.yml b/.github/workflows/python-unit-test.yml index bc0859a..e461fa4 100644 --- a/.github/workflows/python-unit-test.yml +++ b/.github/workflows/python-unit-test.yml @@ -43,7 +43,9 @@ jobs: sudo apt install -y git - name: checkout PR - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Set up Python 2.7 if: ${{ matrix.pyver_os.ver == '2.7' }} @@ -53,7 +55,7 @@ jobs: - name: Set up Python 3 if: ${{ matrix.pyver_os.ver != '2.7' }} - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: python-version: ${{ matrix.pyver_os.ver }} @@ -70,7 +72,7 @@ jobs: tox=tox virtualenv=virtualenv fi - pip install "$tox" "$virtualenv" "git+https://github.com/linux-system-roles/tox-lsr@3.20.1" + pip install "$tox" "$virtualenv" "git+https://github.com/linux-system-roles/tox-lsr@d594be24ed56e586a5796720d51c261e40c20496" # If you have additional OS dependency packages e.g. libcairo2-dev # then put them in .github/config/ubuntu-requirements.txt, one # package per line. @@ -92,4 +94,4 @@ jobs: TOXENV="$toxenvs" lsr_ci_runtox - name: Upload coverage reports to Codecov - uses: codecov/codecov-action@v7 + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7 diff --git a/.github/workflows/qemu-kvm-integration-tests.yml b/.github/workflows/qemu-kvm-integration-tests.yml index 318b7e4..b2371f9 100644 --- a/.github/workflows/qemu-kvm-integration-tests.yml +++ b/.github/workflows/qemu-kvm-integration-tests.yml @@ -52,7 +52,9 @@ jobs: steps: - name: Checkout repo - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Check if platform is supported id: check_platform @@ -111,7 +113,7 @@ jobs: python3 -m pip install --upgrade pip sudo apt update sudo apt install -y --no-install-recommends git ansible-core genisoimage qemu-system-x86 - pip3 install "git+https://github.com/linux-system-roles/tox-lsr@3.20.1" + pip3 install "git+https://github.com/linux-system-roles/tox-lsr@d594be24ed56e586a5796720d51c261e40c20496" - name: Check for podman version 5 or higher id: check_podman_version @@ -128,7 +130,7 @@ jobs: - name: Ensure use of podman 5 if: steps.check_platform.outputs.supported && steps.check_podman_version.outputs.need_podman_update == 1 - uses: redhat-actions/podman-install@main + uses: redhat-actions/podman-install@3b6c60c447c93960c0b76faa0c66c6694bc71350 # main - name: Configure tox-lsr if: steps.check_platform.outputs.supported @@ -212,7 +214,7 @@ jobs: - name: Upload test logs on failure if: failure() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: "logs-${{ matrix.scenario.image }}-${{ matrix.scenario.env }}" path: | @@ -238,7 +240,7 @@ jobs: - name: Set commit status as success with a description that platform is skipped if: ${{ steps.check_platform.outputs.supported == '' }} - uses: myrotvorets/set-commit-status-action@master + uses: myrotvorets/set-commit-status-action@2774e1f040c82ed70a76b4b5cd53bb11ffaedd0a # master with: status: success context: "${{ github.workflow }} / scenario (${{ matrix.scenario.image }}, ${{ matrix.scenario.env }}) (pull_request)" diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml index fee85d9..c1fc644 100644 --- a/.github/workflows/shellcheck.yml +++ b/.github/workflows/shellcheck.yml @@ -30,11 +30,13 @@ jobs: sudo apt install -y git - name: Checkout repo - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Run ShellCheck id: shellcheck_id - uses: ludeeus/action-shellcheck@master + uses: ludeeus/action-shellcheck@00b27aa7cb85167568cb48a3838b75f4265f2bca # master - name: Show file paths scanned run: | diff --git a/.github/workflows/test_converting_readme.yml b/.github/workflows/test_converting_readme.yml index 696275f..bce11fb 100644 --- a/.github/workflows/test_converting_readme.yml +++ b/.github/workflows/test_converting_readme.yml @@ -29,7 +29,9 @@ jobs: sudo apt install -y git - name: Check out code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Remove badges from README.md prior to converting to HTML run: sed -i '1,8 {/^\[\!.*actions\/workflows/d}' README.md @@ -43,7 +45,7 @@ jobs: --output README.html README.md - name: Upload README.html as an artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: README.html path: README.html diff --git a/.github/workflows/tft.yml b/.github/workflows/tft.yml index 12acbc6..de8d0c5 100644 --- a/.github/workflows/tft.yml +++ b/.github/workflows/tft.yml @@ -36,7 +36,9 @@ jobs: GITHUB_CONTEXT: ${{ toJson(github) }} - name: Checkout repo - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Get head sha of the PR id: head_sha @@ -49,8 +51,9 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Checkout PR - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: + persist-credentials: false ref: ${{ steps.head_sha.outputs.head_sha }} - name: Get memory @@ -136,7 +139,7 @@ jobs: - name: Set commit status as pending if: contains(needs.prepare_vars.outputs.supported_platforms, matrix.platform) - uses: myrotvorets/set-commit-status-action@master + uses: myrotvorets/set-commit-status-action@2774e1f040c82ed70a76b4b5cd53bb11ffaedd0a # master with: sha: ${{ needs.prepare_vars.outputs.head_sha }} status: pending @@ -146,7 +149,7 @@ jobs: - name: Set commit status as success with a description that platform is skipped if: "!contains(needs.prepare_vars.outputs.supported_platforms, matrix.platform)" - uses: myrotvorets/set-commit-status-action@master + uses: myrotvorets/set-commit-status-action@2774e1f040c82ed70a76b4b5cd53bb11ffaedd0a # master with: sha: ${{ needs.prepare_vars.outputs.head_sha }} status: success @@ -155,7 +158,7 @@ jobs: targetUrl: "" - name: Run test in testing farm - uses: sclorg/testing-farm-as-github-action@v4 + uses: sclorg/testing-farm-as-github-action@230555baceb860aa468d216f1822974836b965d1 # v4 if: contains(needs.prepare_vars.outputs.supported_platforms, matrix.platform) with: git_ref: main @@ -184,7 +187,7 @@ jobs: tmt_plan_filter: "tag:playbooks_parallel,kernel_settings" - name: Set final commit status - uses: myrotvorets/set-commit-status-action@master + uses: myrotvorets/set-commit-status-action@2774e1f040c82ed70a76b4b5cd53bb11ffaedd0a # master if: always() && contains(needs.prepare_vars.outputs.supported_platforms, matrix.platform) with: sha: ${{ needs.prepare_vars.outputs.head_sha }} diff --git a/.github/workflows/weekly_ci.yml b/.github/workflows/weekly_ci.yml index 856e584..d4fa135 100644 --- a/.github/workflows/weekly_ci.yml +++ b/.github/workflows/weekly_ci.yml @@ -30,8 +30,9 @@ jobs: sudo apt install -y git - name: Checkout latest code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: + persist-credentials: true # needed for commit and push fetch-depth: 0 - name: Create or rebase commit, add dump_packages callback run: | @@ -50,7 +51,7 @@ jobs: git push -f --set-upstream origin ${{ env.BRANCH_NAME }} - name: Create and comment pull request - uses: actions/github-script@v9 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 with: github-token: ${{ secrets.GH_PUSH_TOKEN }} script: | diff --git a/.github/workflows/woke.yml b/.github/workflows/woke.yml index 7f34776..ab44dce 100644 --- a/.github/workflows/woke.yml +++ b/.github/workflows/woke.yml @@ -11,11 +11,13 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Run lsr-woke-action # Originally, uses: get-woke/woke-action@v0 - uses: linux-system-roles/lsr-woke-action@main + uses: linux-system-roles/lsr-woke-action@33e72e28c826f05aaee08d0b70c7d2cd9e0a39a7 # main with: woke-args: "-c https://raw.githubusercontent.com/linux-system-roles/tox-lsr/main/src/tox_lsr/config_files/woke.yml --count-only-error-for-failure" # Cause the check to fail on any broke rules