Security: pin GitHub Actions to SHA hashes - #38
Conversation
Replaces mutable tag/branch references with immutable SHA hashes to prevent supply chain attacks (ref: TeamPCP/Trivy March 2026). Actions left as tags: 0
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.github.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
While this PR successfully addresses the security requirement of pinning GitHub Actions to SHA hashes, it introduces significant logic errors that will cause multiple workflow steps to be skipped. Specifically, environment variables defined within steps are being used in if conditions where they are out of scope.
Additionally, there is a systemic mismatch: the SHAs provided correspond to v3.0.0 of actions/github-script, yet the inline comments still reference v2.0.0. Since v2.0.0 relies on the deprecated Node 12 runtime, it is recommended to explicitly upgrade to the newer versions while ensuring the SHAs and comments are aligned. This PR should not be merged until the environment variable scoping issues are resolved.
About this PR
- Systemic Inconsistency: Across all workflow files, the SHA
6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45(which belongs to v3.0.0) is paired with a# v2.0.0comment. Please verify if the intention was to upgrade or simply pin existing versions, and align the SHAs and comments accordingly. - The pinned actions (v2.0.x) use Node 12, which is deprecated by GitHub. It is highly recommended to upgrade to the latest major versions (e.g., Atlassian actions v3, github-script v7) which use Node 20, and then pin those to SHA hashes.
Test suggestions
- Update actions/github-script, atlassian/gajira-login, and atlassian/gajira-comment in .github/workflows/comment_issue.yml to SHAs.
- Update atlassian/gajira-login, atlassian/gajira-create, and actions/github-script in .github/workflows/create_issue.yml to SHAs.
- Update atlassian/gajira-login, atlassian/gajira-create, and actions/github-script in .github/workflows/create_issue_on_label.yml to SHAs.
🗒️ Improve review quality by adding custom instructions
| if: env.JIRA_CREATE_ISSUE_AUTO == 'true' | ||
| id: create_jira_issue | ||
| uses: atlassian/gajira-create@v2.0.1 | ||
| uses: atlassian/gajira-create@c0a9c69ac9d6aa063fed57201e55336ada860183 # v2.0.1 |
There was a problem hiding this comment.
🔴 HIGH RISK
The step 'Update Jira issue...' will always be skipped because the 'if' condition at line 43 cannot access the environment variable defined at line 45. Move the JIRA_UPDATE_ISSUE_BODY variable to the job-level 'env' block.
| if: env.JIRA_CREATE_COMMENT_AUTO == 'true' && env.GITHUB_ISSUE_TYPE == 'issue' && env.GITHUB_ISSUE_HAS_JIRA_ISSUE_LABEL == 'true' | ||
| id: login | ||
| uses: atlassian/gajira-login@v2.0.0 | ||
| uses: atlassian/gajira-login@90a599561baaf8c05b080645ed73db7391c246ed # v2.0.0 |
There was a problem hiding this comment.
🔴 HIGH RISK
The workflow logic is broken because several 'if' conditions reference environment variables defined within step-level 'env' blocks. These are not accessible during 'if' evaluation. Replace these with step outputs (e.g., steps.step_id.outputs.result) or move the variables to the job-level 'env' block.
| - name: Change Title | ||
| if: github.event.label.name == env.JIRA_ISSUE_LABEL | ||
| uses: actions/github-script@v2.0.0 | ||
| uses: actions/github-script@6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 # v2.0.0 |
There was a problem hiding this comment.
🟡 MEDIUM RISK
Suggestion: The commit SHA 6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 points to v3.0.0, but the comment says v2.0.0. Please align the SHA with the documented version.
| - name: Update GitHub issue | ||
| if: env.JIRA_CREATE_ISSUE_AUTO == 'true' | ||
| uses: actions/github-script@v2.0.0 | ||
| uses: actions/github-script@6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 # v2.0.0 |
There was a problem hiding this comment.
🟡 MEDIUM RISK
Suggestion: The SHA 6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 points to v3.0.0, but the comment specifies v2.0.0. To maintain v2.0.0, use SHA 784e12e3e9d899539d09c3132d733180b5b820a2.
| if: env.JIRA_CREATE_COMMENT_AUTO == 'true' | ||
| id: github_issue_type | ||
| uses: actions/github-script@v2.0.0 | ||
| uses: actions/github-script@6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 # v2.0.0 |
There was a problem hiding this comment.
🟡 MEDIUM RISK
Suggestion: There are two issues here:
- Version Mismatch: The SHA
6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45actually points tov3.0.0, but the comment saysv2.0.0. - Deprecation:
v2.0.0uses Node 12, which is deprecated.
Recommended Fix: Upgrade to the latest version (v7 for github-script) and use its SHA, or if you must stay on v2.0.0, use SHA 784e12e3e9d899539d09c3132d733180b5b820a2.
2 participants
Pins all GitHub Actions from mutable tags/branches to immutable SHA hashes.
This prevents supply chain attacks like the TeamPCP/Trivy incident (March 2026), where attackers force-pushed tags to point at malicious commits.
Auto-generated by the Codacy security audit script.