Security: pin GitHub Actions to SHA hashes - #24
Conversation
Replaces mutable tag/branch references with immutable SHA hashes to prevent supply chain attacks (ref: TeamPCP/Trivy March 2026). Actions left as tags: 0
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.github.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
This PR successfully implements the security practice of pinning GitHub Actions to immutable SHA hashes. However, a significant discrepancy exists across all three workflows: the SHA hash provided for 'actions/github-script' corresponds to version 3.0.0, while the accompanying comments and intent suggest version 2.0.0. This version jump includes breaking changes (such as an Octokit upgrade) that may cause workflow failures. Codacy analysis indicates the PR is up to standards with no new quality or complexity issues detected.
About this PR
- There is a systemic mismatch between the pinned SHAs and the version comments for 'actions/github-script'. The current SHA (6e5ee1d...) points to v3.0.0, while the intention appears to be v2.0.0. Using v3.0.0 may introduce breaking changes into the automation pipeline.
Test suggestions
- Verify that actions/github-script uses the correct SHA for v2.0.0 across all relevant files.
- Verify that atlassian/gajira-login uses the correct SHA for v2.0.0 across all relevant files.
- Verify that atlassian/gajira-comment uses the correct SHA for v2.0.2.
- Verify that atlassian/gajira-create uses the correct SHA for v2.0.1.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify that actions/github-script uses the correct SHA for v2.0.0 across all relevant files.
2. Verify that atlassian/gajira-login uses the correct SHA for v2.0.0 across all relevant files.
3. Verify that atlassian/gajira-comment uses the correct SHA for v2.0.2.
4. Verify that atlassian/gajira-create uses the correct SHA for v2.0.1.
🗒️ Improve review quality by adding custom instructions
| - name: Change Title | ||
| if: github.event.label.name == env.JIRA_ISSUE_LABEL | ||
| uses: actions/github-script@v2.0.0 | ||
| uses: actions/github-script@6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 # v2.0.0 |
There was a problem hiding this comment.
🟡 MEDIUM RISK
The pinned SHA corresponds to v3.0.0, mismatching the v2.0.0 comment. Use the correct SHA for v2.0.0.
| uses: actions/github-script@6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 # v2.0.0 | |
| uses: actions/github-script@24874c9354964e7c7a3641198f3956461c37b30c # v2.0.0 |
| - name: Update GitHub issue | ||
| if: env.JIRA_CREATE_ISSUE_AUTO == 'true' | ||
| uses: actions/github-script@v2.0.0 | ||
| uses: actions/github-script@6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 # v2.0.0 |
There was a problem hiding this comment.
🟡 MEDIUM RISK
The pinned SHA corresponds to v3.0.0, mismatching the v2.0.0 comment. Use the correct SHA for v2.0.0.
| uses: actions/github-script@6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 # v2.0.0 | |
| uses: actions/github-script@24874c9354964e7c7a3641198f3956461c37b30c # v2.0.0 |
| if: env.JIRA_CREATE_COMMENT_AUTO == 'true' | ||
| id: github_issue_type | ||
| uses: actions/github-script@v2.0.0 | ||
| uses: actions/github-script@6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 # v2.0.0 |
There was a problem hiding this comment.
🟡 MEDIUM RISK
The pinned SHA corresponds to v3.0.0, while the comment specifies v2.0.0. To maintain the version used previously, use the correct SHA for v2.0.0.
| uses: actions/github-script@6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 # v2.0.0 | |
| uses: actions/github-script@24874c9354964e7c7a3641198f3956461c37b30c # v2.0.0 |
2 participants
Pins all GitHub Actions from mutable tags/branches to immutable SHA hashes.
This prevents supply chain attacks like the TeamPCP/Trivy incident (March 2026), where attackers force-pushed tags to point at malicious commits.
Auto-generated by the Codacy security audit script.