Skip to content

chore(deps): bump the github-actions-deps group across 1 directory with 2 updates #144

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): bump the github-actions-deps group across 1 directory with 2 updates #144

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/codacy-coverage-reporter.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ jobs:
cache: true

- name: Cache dependencies
uses: actions/cache@v4
uses: actions/cache@v5

@coderabbitai coderabbitai Bot Jun 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo="actions/cache"
tag="v5"

ref_json="$(curl -fsSL "https://api.github.com/repos/${repo}/git/ref/tags/${tag}")"
obj_type="$(jq -r '.object.type' <<<"$ref_json")"
obj_sha="$(jq -r '.object.sha' <<<"$ref_json")"

if [ "$obj_type" = "tag" ]; then
  commit_sha="$(curl -fsSL "https://api.github.com/repos/${repo}/git/tags/${obj_sha}" | jq -r '.object.sha')"
else
  commit_sha="$obj_sha"
fi

printf '%s@%s -> %s\n' "$repo" "$tag" "$commit_sha"

Repository: kubeservice-stack/common

Length of output: 118

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Show the relevant workflow lines around the referenced line
sed -n '1,120p' .github/workflows/codacy-coverage-reporter.yaml | nl -ba | sed -n '1,120p'

# Extract any actions/cache usage from the workflow
rg -n "uses:\s*actions/cache@" .github/workflows/codacy-coverage-reporter.yaml || true

# Check whether any workflows pin actions/cache to a SHA elsewhere in the repo
rg -n "uses:\s*actions/cache@" .github/workflows || true

Repository: kubeservice-stack/common

Length of output: 111

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow head (for line context) =="
cat -n .github/workflows/codacy-coverage-reporter.yaml | sed -n '1,120p'

echo
echo "== actions/cache usage in this workflow =="
rg -n "uses:\s*actions/cache@" .github/workflows/codacy-coverage-reporter.yaml || true

echo
echo "== actions/cache usage elsewhere in repo (workflows only) =="
rg -n "uses:\s*actions/cache@" .github/workflows || true

Repository: kubeservice-stack/common

Length of output: 1866

🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n "unpinned-uses" . || true
rg -n "pinned.*uses|pin.*uses|hardening for github actions|security hardening|retargeting" .github README* docs* || true

Repository: kubeservice-stack/common

Length of output: 114

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== repo root =="
ls -la

echo
echo "== search: unpinned-uses =="
rg -n "unpinned-uses" . || true

echo
echo "== search: hardening/pinning/retargeting keywords =="
rg -n "unpinned|pinned.*uses|pin.*uses|retarget|tag retarget|security hardening|hardening for github actions|hardening.*actions" . || true

echo
echo "== search: any policy/config files mentioning actions security/hardening =="
fd -e yml -e yaml -e json -e md -e toml -e config . | wc -l >/dev/null
fd -e yml -e yaml -e json -e toml -e md -e config . | rg -n "(policy|security|hardening|action|github|workflow)" || true

Repository: kubeservice-stack/common

Length of output: 1159

🌐 Web query:

GitHub Actions security hardening unpinned-uses policy enforce full-length commit SHA for actions at org repo level

💡 Result:

GitHub provides an organization-level policy to enforce the use of full-length commit SHAs for GitHub Actions [1][2]. This security control helps mitigate supply chain risks by ensuring that workflows execute immutable versions of actions, preventing attacks where malicious code is injected into mutable references like tags or branches [1][3][4]. Policy Configuration To enable this enforcement, organization owners can navigate to Organization Settings > Actions > General > Policies [5]. Within this section, there is a setting labeled "Require actions to be pinned to a full-length commit SHA" [1][6]. When enabled, any workflow that attempts to use an action not pinned to a full-length (40-character) commit SHA will fail [2][5]. Key Considerations for Enforcement: - Scope: This policy applies to direct 'uses' references in workflow files [5]. It is a critical component of a broader security hardening strategy but should be combined with other controls, as it does not inherently verify transitive dependencies (e.g., actions that pull other mutable code at runtime) or automatically apply to reusable workflows in the same manner [4][5]. - Governance and Blocking: GitHub also allows for explicit allow and block lists for actions [2][6]. Administrators can combine these policies by using '!' to block specific actions or versions, and ',!owner/repo@' to control allowed action usage across the organization [6][7]. - Complementary Practices: Because SHA pinning alone does not guarantee that an action's internal dependencies or execution logic are immutable, security experts recommend additional practices such as: - Enabling Dependabot to manage and update SHA-pinned actions [2][3]. - Conducting periodic drift audits to identify when upstream maintainers update tags [5]. - Utilizing additional runtime security tools (e.g., harden-runner) to monitor egress traffic or token exposure [4][5]. - Implementing pre-commit hooks or linting (e.g., actionlint) to catch non-compliant references before they are pushed to the repository [5].

Citations:

Pin actions/cache to a full commit SHA

The workflow step Cache dependencies uses the mutable tag actions/cache@v5 (line 26). Tags can be retargeted; GitHub’s hardening guidance recommends pinning GitHub Actions to full-length commit SHAs (and org policy can enforce this). https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions

        uses: actions/cache@v5
🧰 Tools
🪛 zizmor (1.25.2)

[error] 26-26: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

[error] 26-26: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default

(cache-poisoning)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/codacy-coverage-reporter.yaml at line 26, The workflow
step "Cache dependencies" is using the mutable tag `actions/cache@v5`; update
that `uses:` entry to pin to the full commit SHA for the v5 release (replace
`actions/cache@v5` with `actions/cache@<full-commit-sha>`). Locate the commit
SHA by opening the actions/cache repository tags/releases for v5 and copy the
full 40-char commit SHA, then update the workflow entry so the "Cache
dependencies" step uses that SHA; commit the change to ensure the action is
immutably pinned.

with:
path: |
~/go/pkg/mod
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/go.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,7 +96,7 @@ jobs:
cache: true

- name: Cache dependencies
uses: actions/cache@v4
uses: actions/cache@v5

@coderabbitai coderabbitai Bot Jun 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

resolve_tag() {
  local repo="$1"
  local tag="$2"

  local ref_json obj_type obj_sha commit_sha
  ref_json="$(curl -fsSL "https://api.github.com/repos/${repo}/git/ref/tags/${tag}")"
  obj_type="$(jq -r '.object.type' <<<"$ref_json")"
  obj_sha="$(jq -r '.object.sha' <<<"$ref_json")"

  if [ "$obj_type" = "tag" ]; then
    commit_sha="$(curl -fsSL "https://api.github.com/repos/${repo}/git/tags/${obj_sha}" | jq -r '.object.sha')"
  else
    commit_sha="$obj_sha"
  fi

  printf '%s@%s -> %s\n' "$repo" "$tag" "$commit_sha"
}

resolve_tag "actions/cache" "v5"
resolve_tag "codecov/codecov-action" "v6.0.1"

Repository: kubeservice-stack/common

Length of output: 118

Pin GitHub Action references to immutable commit SHAs.

In .github/workflows/go.yml, the workflow uses tag-based action refs at lines 99, 112, 135, and 151 (e.g., actions/cache@v5, codecov/codecov-action@v6.0.1). Tag refs are mutable; pinning to full commit SHAs provides stronger supply-chain hardening. (GitHub security hardening for GitHub Actions)

🧰 Tools
🪛 zizmor (1.25.2)

[error] 99-99: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/go.yml at line 99, Replace mutable tag-based GitHub Action
refs with immutable commit SHAs: find the action references like
actions/cache@v5, codecov/codecov-action@v6.0.1 and any other tag refs in the
workflow (the occurrences flagged such as the refs around those symbols) and
update them to use the corresponding full commit SHA from each action's
repository (eg actions/cache@<full-commit-sha>); fetch the exact commit SHAs
from the upstream action repos or GitHub Marketplace, verify compatibility, and
commit the updated refs so every use of those action identifiers is pinned to a
specific immutable SHA.

with:
path: |
~/go/pkg/mod
Expand All @@ -109,7 +109,7 @@ jobs:
run: go test -race -coverprofile=coverage.out -coverpkg=./... ./... -count=1

- name: Upload coverage to codecov.io
uses: codecov/codecov-action@v6.0.0
uses: codecov/codecov-action@v7.0.0
with:
files: coverage.out
fail_ci_if_error: false
Expand All @@ -132,7 +132,7 @@ jobs:
cache: true

- name: Cache dependencies
uses: actions/cache@v4
uses: actions/cache@v5
with:
path: |
~/go/pkg/mod
Expand All @@ -148,4 +148,4 @@ jobs:
run: go test -coverprofile=cover.out -coverpkg=./... ./... && go tool cover -html=cover.out -o cover.html && true

- name: Upload coverage to codecov.io
uses: codecov/codecov-action@v6.0.0
uses: codecov/codecov-action@v7.0.0
Loading