Skip to content

fix: pin 6 unpinned action(s)#7343

Closed
dagecko wants to merge 1 commit intoTheAlgorithms:masterfrom
dagecko:runner-guard/fix-ci-security
Closed

fix: pin 6 unpinned action(s)#7343
dagecko wants to merge 1 commit intoTheAlgorithms:masterfrom
dagecko:runner-guard/fix-ci-security

Conversation

@dagecko
Copy link

@dagecko dagecko commented Mar 26, 2026

Security: Harden GitHub Actions workflows

Hey, we found some CI/CD security issues in this repo's workflows using Runner Guard, our open-source CI/CD security scanner at Vigilant. These are the same vulnerability classes being actively exploited right now in the tj-actions, Trivy, LiteLLM supply chain attack chain. We scanned the top 50K repos on GitHub and over 20,000 have this same problem. We're trying to get fixes out to as many maintainers as possible before more repos get hit.

This PR fixes what we could automatically, and flags anything else that needs a manual look. There's a real person behind this PR, we're actively checking back on comments so if you have any questions just drop them here and we'll respond.

Fixes applied (in this PR)

Rule Severity File Description
RGS-007 high .github/workflows/build.yml Pinned 2 third-party action(s) to commit SHA
RGS-007 high .github/workflows/clang-format-lint.yml Pinned 1 third-party action(s) to commit SHA
RGS-007 high .github/workflows/infer.yml Pinned 1 third-party action(s) to commit SHA
RGS-007 high .github/workflows/update-directorymd.yml Pinned 2 third-party action(s) to commit SHA

Advisory: additional findings (manual review recommended)

No additional findings beyond the fixes applied above.

Why this matters

GitHub Actions workflows that use untrusted input in run: blocks, expose
secrets inline, or use unpinned third-party actions are vulnerable to
code injection, credential theft, and supply chain attacks. These are the same
vulnerability classes exploited in the tj-actions/changed-files incident
and subsequent supply chain attacks, which compromised CI secrets across
thousands of repositories.

How to verify

Review the diff — each change is mechanical and preserves workflow behavior:

  • SHA pinning (RGS-007): Pins third-party actions to immutable commit SHAs
    (original version tag preserved as comment)

Run brew install Vigilant-LLC/tap/runner-guard && runner-guard scan . or install from the
repo to verify.


Found by Runner Guard | Built by Vigilant Cyber Security | Learn more

If this PR is not welcome, just close it -- we won't send another.

Automated security fixes applied by Runner Guard (https://github.com/Vigilant-LLC/runner-guard).

Changes:
 .github/workflows/build.yml              | 4 ++--
 .github/workflows/clang-format-lint.yml  | 2 +-
 .github/workflows/infer.yml              | 2 +-
 .github/workflows/update-directorymd.yml | 4 ++--
 4 files changed, 6 insertions(+), 6 deletions(-)
@codecov-commenter
Copy link

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.46%. Comparing base (ebcf5ad) to head (ff58282).

Additional details and impacted files
@@            Coverage Diff            @@
##             master    #7343   +/-   ##
=========================================
  Coverage     79.46%   79.46%           
- Complexity     7083     7084    +1     
=========================================
  Files           790      790           
  Lines         23164    23164           
  Branches       4556     4556           
=========================================
  Hits          18407    18407           
- Misses         4021     4022    +1     
+ Partials        736      735    -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens the repository’s GitHub Actions workflows by pinning previously unpinned third-party actions to immutable commit SHAs to reduce supply-chain risk.

Changes:

  • Pin codecov/codecov-action usages in the build workflow to a commit SHA (keeping the original v5 tag as a comment).
  • Pin DoozyX/clang-format-lint-action to a commit SHA (keeping the original v0.20 tag as a comment).
  • Pin ocaml/setup-ocaml, DenizAltunkapan/directory-tree-generator, and peter-evans/create-pull-request to commit SHAs (keeping their original version tags as comments).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File Description
.github/workflows/build.yml Pins Codecov action references to a commit SHA for workflow supply-chain hardening.
.github/workflows/clang-format-lint.yml Pins the clang-format-lint third-party action to a commit SHA.
.github/workflows/infer.yml Pins the OCaml setup third-party action to a commit SHA.
.github/workflows/update-directorymd.yml Pins directory generation and PR creation third-party actions to commit SHAs.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@dagecko dagecko closed this by deleting the head repository Mar 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants