fix: pin 1 unpinned action(s),extract 1 unsafe expression(s) to env vars#402
Open
dagecko wants to merge 1 commit intopypa:unstable/v1from
Open
fix: pin 1 unpinned action(s),extract 1 unsafe expression(s) to env vars#402dagecko wants to merge 1 commit intopypa:unstable/v1from
dagecko wants to merge 1 commit intopypa:unstable/v1from
Conversation
Automated security fixes applied by Runner Guard (https://github.com/Vigilant-LLC/runner-guard). Changes: .github/workflows/build-and-push-docker-image.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR hardens your CI/CD workflows against supply chain attacks by pinning a third-party GitHub Action to an immutable commit SHA and extracting a secret from a
run:block into anenv:mapping.Why this matters
The build-and-push workflow references
re-actors/alls-green@release/v1on a mutable tag in a pipeline that haspackages: writepermission to your container registry.Over the last 5 weeks I've been tracking a nation state actor targeting maintainers of high profile open source projects through social engineering campaigns designed to compromise their accounts. The attack pattern we've seen with tj-actions, Trivy, and Axios all followed the same vector: compromise a maintainer account, force-push malicious code to a mutable tag, and every downstream project silently executes the attacker's code.
If the
re-actors/alls-greenmaintainer account were compromised, the attacker could replace whatrelease/v1points to. Their modified action would then execute in this workflow with write access to your package registry. Pinning to the commit SHA prevents this because a pinned hash cannot be moved even if the upstream account is compromised.Fixes applied (in this PR)
build-and-push-docker-image.ymlbuild-and-push-docker-image.ymlsecrets.GITHUB_TOKENfrom docker login run block to env mappingHow to verify
Every change is mechanical and preserves workflow behavior:
action@release/v1becomesaction@abc123 # release/v1- original ref preserved as comment${{ secrets.GITHUB_TOKEN }}moves from therun:block to anenv:mapping, preventing shell interpretationI've had 29 merges so far. I created a tool called Runner Guard to assist in my research - it does mechanical, non-AI fixes to reduce hallucinations to zero and produce consistent fixes. If you would like to scan it yourself to validate my work, feel free.
Happy to answer any questions - I'm monitoring comms on every PR.
- Chris Nyhuis (dagecko)