Security: pin GitHub Actions to SHA hashes - #36
Conversation
Replaces mutable tag/branch references with immutable SHA hashes to prevent supply chain attacks (ref: TeamPCP/Trivy March 2026). Actions left as tags: 0
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.github.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
While this PR correctly identifies the need to pin GitHub Actions to SHA hashes for security hardening, several critical implementation errors prevent it from being merged. There is a major version mismatch: the SHA hashes used correspond to actions/github-script v6.3.3, but the code comments and existing script logic assume v2.0.0. This will cause immediate workflow failures as the github object API changed significantly in v5. Additionally, the PR introduces/maintains an Expression Injection vulnerability by interpolating GitHub expressions directly into script blocks. These logic and security regressions must be addressed to satisfy the acceptance criteria.
About this PR
- Systemic version mismatch detected: The SHA hashes provided for
actions/github-scriptconsistently point to v6.3.3, while all associated comments and scripts target v2.0.0. A unified decision should be made to either use v2.0.0 SHAs or upgrade the scripts to the v6/v7 API. - The PR description refers to a supply chain incident in 'March 2026', which appears to be placeholder or inaccurate data. Please ensure the context for these security changes is grounded in current requirements.
Test suggestions
- Verify that all actions/github-script steps remain functional with the pinned SHA (potential breaking changes from v2 to v6).
- Confirm SHA hashes for atlassian/gajira actions match the v2.0.0 release.
- Execute the 'Create issue on Jira' workflow to ensure Octokit calls (github.issues.update) are compatible with the pinned version.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify that all actions/github-script steps remain functional with the pinned SHA (potential breaking changes from v2 to v6).
2. Execute the 'Create issue on Jira' workflow to ensure Octokit calls (github.issues.update) are compatible with the pinned version.
🗒️ Improve review quality by adding custom instructions
| - name: Add comment after sync | ||
| if: env.JIRA_CREATE_ISSUE_AUTO == 'true' | ||
| uses: actions/github-script@v2.0.0 | ||
| uses: actions/github-script@6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 # v2.0.0 |
There was a problem hiding this comment.
🔴 HIGH RISK
Using ${{ }} expression interpolation directly inside the script block is a security risk (Expression Injection). This allows external data to be interpreted as JavaScript code. Pass these values via the env block and access them through process.env instead.
| - name: Update GitHub issue | ||
| if: env.JIRA_CREATE_ISSUE_AUTO == 'true' | ||
| uses: actions/github-script@v2.0.0 | ||
| uses: actions/github-script@6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 # v2.0.0 |
There was a problem hiding this comment.
🔴 HIGH RISK
Version mismatch detected. The pinned SHA (v6.3.3) is incompatible with the Octokit call at line 65 (github.issues.update), which expects the v2.0.0 environment. In v6+, this must be updated to github.rest.issues.update.
| if: env.JIRA_CREATE_COMMENT_AUTO == 'true' && env.GITHUB_ISSUE_TYPE == 'issue' && env.GITHUB_ISSUE_HAS_JIRA_ISSUE_LABEL == 'true' | ||
| id: login | ||
| uses: atlassian/gajira-login@v2.0.0 | ||
| uses: atlassian/gajira-login@90a599561baaf8c05b080645ed73db7391c246ed # v2.0.0 |
There was a problem hiding this comment.
🔴 HIGH RISK
The step condition at line 57 will always evaluate to false because it references environment variables defined within a step's env block, which are not available to that step's if condition. Use the step outputs directly instead: steps.github_issue_type.outputs.result.
| if: env.JIRA_CREATE_COMMENT_AUTO == 'true' | ||
| id: github_issue_type | ||
| uses: actions/github-script@v2.0.0 | ||
| uses: actions/github-script@6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 # v2.0.0 |
There was a problem hiding this comment.
🔴 HIGH RISK
A significant version mismatch exists: the SHA hash (6e5ee1d...) corresponds to actions/github-script v6.3.3, while the adjacent comment specifies v2.0.0. This creates two conflicts: (1) The v6.3.3 environment breaks script logic that expects the v2.0.0 API. (2) If the SHA is reverted to v2.0.0 to match the comment, the result-encoding: string input will fail as it was not introduced until v3.0.0. Please upgrade to a modern version (v7+) and update the script logic to use the github.rest API.
2 participants
Pins all GitHub Actions from mutable tags/branches to immutable SHA hashes.
This prevents supply chain attacks like the TeamPCP/Trivy incident (March 2026), where attackers force-pushed tags to point at malicious commits.
Auto-generated by the Codacy security audit script.