From b00ab13e61183c69e048f49995fdee64c56c0971 Mon Sep 17 00:00:00 2001 From: Pim Feltkamp <48278217+pimfeltkamp@users.noreply.github.com> Date: Tue, 3 Nov 2026 01:25:39 +0100 Subject: [PATCH] Security: pin GitHub Actions in release and CI workflows to commit SHAs release.yml runs with id-token: write (RubyGems trusted publishing) and contents: write, but referenced actions/checkout, ruby/setup-ruby, rubygems/configure-rubygems-credentials and softprops/action-gh-release by mutable tag. A retagged or compromised upstream action would execute inside the job that can mint the gem-publishing OIDC token. Pin each action to the full commit SHA its tag currently resolves to, with a version comment so Dependabot (github-actions ecosystem) keeps bumping them. ci.yml uses the same two actions and shares the bundler cache with release runs, so it is pinned to the identical SHAs. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/ci.yml | 4 ++-- .github/workflows/release.yml | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 588bc96..db4ba5e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,8 +12,8 @@ jobs: matrix: ruby: ["3.2", "3.3"] steps: - - uses: actions/checkout@v6 - - uses: ruby/setup-ruby@v1 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: ruby/setup-ruby@de492cf36cbab201753d720ce4f4e336cd688c94 # v1.336.0 with: ruby-version: ${{ matrix.ruby }} bundler-cache: true diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 38285b5..fb8bafa 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,9 +19,9 @@ jobs: name: rubygems url: https://rubygems.org/gems/cryptohopper steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - - uses: ruby/setup-ruby@v1 + - uses: ruby/setup-ruby@de492cf36cbab201753d720ce4f4e336cd688c94 # v1.336.0 with: ruby-version: "3.3" bundler-cache: true @@ -42,7 +42,7 @@ jobs: fi - name: Configure RubyGems credentials (OIDC) - uses: rubygems/configure-rubygems-credentials@v1.0.0 + uses: rubygems/configure-rubygems-credentials@bc6dd217f8a4f919d6835fcfefd470ef821f5c44 # v1.0.0 with: audience: rubygems.org @@ -53,7 +53,7 @@ jobs: run: gem push cryptohopper-*.gem - name: Create GitHub Release - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 with: files: "*.gem" generate_release_notes: true