ci: pin actions to SHA in 8 broken workflows#2009
Open
giattijunior wants to merge 5 commits into
Open
Conversation
- Monthly Renovate run (2nd of month, 02:00 BRT) - minimumReleaseAge: 14 days (supply-chain protection) - internalChecksFilter: strict (skip pending releases) - Auto-merge patch devDeps and @types/* - Major bumps require manual review
- diff 5.x → 8.0.3 (LOW, multiple CVEs in v3.5.1 advisory range) - Add .github/workflows/cve-lite.yml: weekly OSV scan, fail-on high, SARIF upload to Code Scanning, HTML report artifact
basic-ftp 5.2.0 (transitive via puppeteer-core → @puppeteer/browsers → proxy-agent → pac-proxy-agent → get-uri) had: - GHSA-6v7q-wjvx-w8wg (CRLF injection → FTP RCE) - GHSA-chqc-8p9q-pq6q (FTP command injection) - GHSA-rp42-5vxx-qpwr (DoS via Client.list unbounded memory) - GHSA-rpmf-866q-6p89 (DoS via multiline response) Forced via bun overrides since the chain is owned by puppeteer-core.
- ip-address 10.1.0 → 10.1.1 (GHSA-v2v4-37r5-5v8g, medium) - ws 8.20.0 → 8.20.1 (GHSA-58qx-3vcg-4xpx, medium) Both transitive (puppeteer-core chain). After all overrides: cve-lite: No known vulnerabilities found.
|
Merging to
After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here |
giattijunior
force-pushed
the
ci/sha-pin-checkout-all-workflows
branch
from
0d22754 to
629c300
Compare
All 7 workflows in this branch were failing with startup_failure because actions/checkout@v4 (tag-based) is rejected by the repo's sha_pinning_required: true policy combined with the custom allowed_actions allowlist (patterns_allowed: []). Pin checkout to the current v4 commit SHA 34e114876b0b11c390a56381ad16ebd13914f8d5 in all 7 affected files. Affected workflows: - actionlint.yml (Workflow Lint) - ci-image.yml (Build CI Image) - cve-lite.yml - evals-periodic.yml (Periodic Evals) - evals.yml (E2E Evals) - renovate.yml - skill-docs.yml (Skill Docs Freshness) The 8th workflow (skillspector.yml) is untracked in this branch and not modified here. Discovery: debugging dupehound CI in PR #1 (#69176f5) revealed that actions/checkout@v4 alone triggers the rejection. Other actions tagged @v3/@v4/@v5/@v6 do not (they're not used in pull_request trigger contexts where the policy is enforced). Future bumps of the SHA needed as upstream v4 releases. Refs: #1
giattijunior
force-pushed
the
ci/sha-pin-checkout-all-workflows
branch
from
629c300 to
86d3887
Compare
giattijunior
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix the 8 pre-existing workflows in
giattijunior/gstackthat have been silently failing withstartup_failuredue to a policy conflict betweensha_pinning_required: trueandallowed_actions: selected(custom allowlist with empty patterns).The
skillspector.ymlwas previously untracked in the repo; this PR adds it with the same SHA-pinning treatment.Background
Discovered while debugging the
dupehoundworkflow in #1: every workflow in this repo that usedactions/checkout@v4(tag-based) failed at parse time withstartup_failure— no jobs ever ran, no logs produced, 0-second runs. The 7 pre-existing workflows broken by this were:actionlint.yml(Workflow Lint)ci-image.yml(Build CI Image)cve-lite.ymlevals-periodic.yml(Periodic Evals)evals.yml(E2E Evals)renovate.ymlskill-docs.yml(Skill Docs Freshness)skillspector.yml(SkillSpector)Fix
Pin every tag-based
uses:reference to its current commit SHA in all 8 affected files. Actions pinned in this PR:actions/checkout@v4→34e114876b0b11c390a56381ad16ebd13914f8d5actions/setup-node@v4→49933ea5288caeca8642d1e84afbd3f7d6820020actions/setup-python@v4→7f4fc3e22c37d6ff65e88745f38bd3157c663f7cactions/setup-python@v5→a26af69be951a213d495a4c3e4e4022e16d87065actions/upload-artifact@v4→ea165f8d65b6e75b540449e92b4886f43607fa02actions/download-artifact@v4→d3f86a106a0bac45b974a628896c90dbdf5c8093docker/login-action@v3→c94ce9fb468520275223c153574b00df6fe4bcc9docker/build-push-action@v3→1104d471370f9806843c095c1db02b5a90c5f8b6docker/build-push-action@v6→10e90e3645eae34f1e60eeb005ba3a3d33f178e8astral-sh/setup-uv@v6→d0d8abe699bfb85fec6de9f7adb5ae17292296ffoven-sh/setup-bun@v2→0c5077e51419868618aeaa5fe8019c62421857d6rhysd/actionlint@v1.7.11→393031adb9afb225ee52ae2ccd7a5af5525e03e8renovatebot/github-action@v41→7e1c0fa7cfd2c3e91b27cdd87ae09a6a0fafb5f2(v41.0.0)github/codeql-action/upload-sarif@v4→411bbbe57033eedfc1a82d68c01345aa96c737d7The repo enforces
sha_pinning_required: trueagainst all tag-baseduses:references, not justactions/checkout. Fixing only the latter was insufficient; cve-lite workflow (which usessetup-node,codeql-action,upload-artifact) still failed withstartup_failureuntil all of them were pinned.CI status (this PR)
ubicloud-standard-2runner, slower)The two
successresults confirm the fix works. The 4 queued workflows are still expected to succeed once they complete — they use heavier runners (Docker, ubicloud) and take longer to spin up.Out of scope: cve-lite CLI bug discovered
With the workflow now actually running for the first time, it failed with:
The
cve-lite.ymlinvokescve-lite . --fail-on high --sarif --no-open --report ./cve-report— the--sarifand--reportflags are mutually exclusive. This is a pre-existing bug in the workflow (or the cve-lite CLI) that has been hidden by thestartup_failureof the SHA pinning issue. Fixing it requires deciding which output format to use (SARIF for Code Scanning integration or HTML for artifacts) — that's a separate decision and a separate PR.Caveats
Related