Skip to content

security(high/easy): enforce SHA-pinned and allowlisted GitHub Actions #489

Open
#562
Open
security(high/easy): enforce SHA-pinned and allowlisted GitHub Actions#489
#562
Assignees
sulaimonifeoluwa4-blip
Labels
Stellar WaveIssue proposed for the Drips Stellar Wave programarea: ciContinuous integration and developer toolingpriority: highUrgent work with high project or security impactsecuritySecurity, supply-chain, and repository-hardening work

Description

@karagozemin
karagozemin
opened on Oct 21, 2026

Why

The repository currently allows all GitHub Actions and does not enforce SHA pinning at the settings level. File-level pins from #481 should be backed by a repository policy.

Scope

After #481 is merged, restrict Actions to the reviewed set and require full-length SHA pins.

Acceptance criteria

  • Complete only after every external action is pinned by security(ci): pin third-party GitHub Actions to immutable commit SHAs #481.
  • Enable the repository setting that requires full-length commit SHA pins.
  • Restrict allowed actions to GitHub-owned, verified, and the explicitly reviewed third-party actions used by this repository.
  • Verify all four existing workflows still start successfully.
  • Document the final allowlist in this issue.

Do not broaden workflow token permissions.

Activity

  1. karagozemin
    added
    area: ciContinuous integration and developer tooling
    priority: highUrgent work with high project or security impact
    securitySecurity, supply-chain, and repository-hardening work
    on Oct 21, 2026
  2. drips-wave
    added
    Stellar WaveIssue proposed for the Drips Stellar Wave program
    on Oct 21, 2026

  3. krsnak commented on Oct 21, 2026

    @krsnak
    krsnak
    on Oct 21, 2026 – with Drips Wave

    @krsnak has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    Hi, I’d like to work on this. After #481 is merged, I’ll verify all external actions use full-length SHA pins, enforce SHA pinning in repository settings, and configure the reviewed Actions allowlist. I’ll then verify all four workflows start successfully, document the final allowlist, and preserve existing token permissions. Thanks!

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @krsnak to this issue.

  4. sulaimonifeoluwa4-blip commented on Oct 21, 2026

    @sulaimonifeoluwa4-blip
    sulaimonifeoluwa4-blip
    on Oct 21, 2026 – with Drips Wave

    @sulaimonifeoluwa4-blip has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    Hi can I work o this

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @sulaimonifeoluwa4-blip to this issue.

  5. emirykl commented on Oct 21, 2026

    @emirykl
    emirykl
    on Oct 21, 2026 – with Drips Wave
    Contributor

    @emirykl has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    Hey, I want to take that issue

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @emirykl to this issue.

  6. VeronicDev commented on Oct 21, 2026

    @VeronicDev
    VeronicDev
    on Oct 21, 2026 – with Drips Wave

    @VeronicDev has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    pls assign

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @VeronicDev to this issue.

  7. Devadakene commented on Oct 21, 2026

    @Devadakene
    Devadakene
    on Oct 21, 2026 – with Drips Wave

    @Devadakene has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    I would like to work on this issue having worked on something similar issues in the past. Please assign

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @Devadakene to this issue.

  8. karagozemin
    assigned
    sulaimonifeoluwa4-blip
    on Oct 21, 2026

  9. drips-wave commented on Oct 21, 2026

    @drips-wave
    drips-waveBot
    on Oct 21, 2026 – with Drips Wave

    Congratulations, @sulaimonifeoluwa4-blip! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on October 22, 2026.

    🧑‍💻 @sulaimonifeoluwa4-blip: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

    Warning

    When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

    🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

    🌊 Happy Wave 🌊

  10. sulaimonifeoluwa4-blip commented on Oct 23, 2026

    @sulaimonifeoluwa4-blip
    sulaimonifeoluwa4-blip
    on Oct 23, 2026

    Final allowlist for this issue, implemented in #562 (docs/CI.md mirrors this table):

    Action Full-length SHA Upstream ref
    actions/checkout 11d5960a326750d5838078e36cf38b85af677262 v4.4.0
    actions/setup-node 49933ea5288caeca8642d1e84afbd3f7d6820020 v4.4.0
    pnpm/action-setup b906affcce14559ad1aafd4ab0e942779e9f58b1 v4.3.0
    dtolnay/rust-toolchain b725eda525362e7cf34af9a7243cac1e3f01a7ec stable
    Swatinem/rust-cache d1527c8f67ef9af357290475d4af4b0fab8f12e0 v2.9.3

    Notes:

    • These are the commits the previously used mutable refs (@v4, @stable, @v2) resolved to; no action code changed.
    • dtolnay/rust-toolchain now passes toolchain: stable explicitly, because the toolchain can no longer be read from a SHA ref.
    • .github/actions-allowlist.json is the reviewed allowlist; scripts/check-actions-policy.mjs fails on unpinned refs, unknown actions, unreviewed SHAs, unused allowlist entries, docker:// actions, and write permissions. Actions policy runs it in CI.
    • Remaining step for maintainers (not storable in git): Settings → Actions → General → allow GitHub-owned + verified Marketplace + pnpm/action-setup, dtolnay/rust-toolchain, Swatinem/rust-cache, and enable "Require actions to be pinned to a full-length commit SHA".

  11. drips-wave commented on Oct 27, 2026

    @drips-wave
    drips-waveBot
    on Oct 27, 2026 – with Drips Wave

    This issue has been marked as completed by a Drips Wave moderator for @sulaimonifeoluwa4-blip as part of the Stellar Wave Program's 10th Wave 🥳

    Moderator's reason: [Auto-assessed] The PR is open with no maintainer response or objections across any of the four channels. The PR content looks like a genuine, quality contribution that successfully addresses issue #489 by pinning all GitHub Actions to full-length SHAs, implementing a policy checker, adding comprehensive unit tests, and documenting the allowlist.

    😎 @sulaimonifeoluwa4-blip: You earned 200 Points for completing this issue! Once the Wave's rewards are finalized, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here.

    🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.

    ℹ️ Note: This issue was marked complete via moderation. Points were issued even though the GitHub issue remains open.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Stellar WaveIssue proposed for the Drips Stellar Wave programarea: ciContinuous integration and developer toolingpriority: highUrgent work with high project or security impactsecuritySecurity, supply-chain, and repository-hardening work

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions