From 361c51648d7181f494713ab745c0f7f3348bfb1c Mon Sep 17 00:00:00 2001 From: Thibaud-Vdb Date: Mon, 10 Aug 2026 13:39:41 +0200 Subject: [PATCH 1/3] Pin the release, docker and CI actions to full commit SHAs The release path runs goreleaser with a token that can create releases, and the docker push workflow logs into Docker Hub with the registry credentials. Every action in those workflows was referenced by a mutable tag, and whoever controls an action repository can point a tag at different code after the fact. The tj-actions/changed-files incident (CVE-2025-30066) rewrote tags exactly this way to leak CI secrets. A commit SHA cannot be retargeted. This also settles the codeql-action refs, where v2 resolves as both a tag and a branch upstream and which revision runs is ambiguous. The projectdiscovery/actions pins cover the org's own actions for consistency, happy to drop those hunks if you prefer trusting the org namespace. Each pin keeps the version as a trailing comment for review, versions stay exactly where they were, and dependabot bumps SHA pins the same way it bumps tags today. --- .github/workflows/auto-merge.yaml | 4 ++-- .github/workflows/build-test.yml | 10 +++++----- .github/workflows/codeql-analysis.yml | 8 ++++---- .github/workflows/compatibility-checks.yaml | 4 ++-- .github/workflows/dep-auto-merge.yml | 4 ++-- .github/workflows/dockerhub-push.yml | 10 +++++----- .github/workflows/functional-test.yml | 4 ++-- .github/workflows/release-binary.yml | 6 +++--- .github/workflows/release-test.yml | 6 +++--- .github/workflows/stale.yaml | 2 +- 10 files changed, 29 insertions(+), 29 deletions(-) diff --git a/.github/workflows/auto-merge.yaml b/.github/workflows/auto-merge.yaml index 0ff3098e6..96cb4640d 100644 --- a/.github/workflows/auto-merge.yaml +++ b/.github/workflows/auto-merge.yaml @@ -18,11 +18,11 @@ jobs: runs-on: ubuntu-latest if: github.actor == 'dependabot[bot]' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: token: ${{ secrets.DEPENDABOT_PAT }} - - uses: ahmadnassri/action-dependabot-auto-merge@v2 + - uses: ahmadnassri/action-dependabot-auto-merge@45fc124d949b19b6b8bf6645b6c9d55f4f9ac61a # v2.6.6 with: github-token: ${{ secrets.DEPENDABOT_PAT }} target: all \ No newline at end of file diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml index 11bda1298..d1808b45b 100644 --- a/.github/workflows/build-test.yml +++ b/.github/workflows/build-test.yml @@ -13,9 +13,9 @@ jobs: if: ${{ !endsWith(github.actor, '[bot]') }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: projectdiscovery/actions/setup/go@v1 - - uses: projectdiscovery/actions/golangci-lint/v2@v1 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: projectdiscovery/actions/setup/go@4ff2f2094e67bb1819a069aa130a49463ecaa3f3 # v1.29.4 + - uses: projectdiscovery/actions/golangci-lint/v2@4ff2f2094e67bb1819a069aa130a49463ecaa3f3 # v1.29.4 build: name: Test Builds @@ -25,8 +25,8 @@ jobs: matrix: os: [ubuntu-latest, windows-latest, macOS-latest] steps: - - uses: actions/checkout@v4 - - uses: projectdiscovery/actions/setup/go@v1 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: projectdiscovery/actions/setup/go@4ff2f2094e67bb1819a069aa130a49463ecaa3f3 # v1.29.4 - run: go build . working-directory: cmd/httpx/ diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 3080047d4..1369659ff 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -25,16 +25,16 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v2 + uses: github/codeql-action/init@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1 with: languages: ${{ matrix.language }} - name: Autobuild - uses: github/codeql-action/autobuild@v2 + uses: github/codeql-action/autobuild@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v2 \ No newline at end of file + uses: github/codeql-action/analyze@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1 \ No newline at end of file diff --git a/.github/workflows/compatibility-checks.yaml b/.github/workflows/compatibility-checks.yaml index a2641e701..b0cb1ad93 100644 --- a/.github/workflows/compatibility-checks.yaml +++ b/.github/workflows/compatibility-checks.yaml @@ -13,7 +13,7 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v4 - - uses: projectdiscovery/actions/setup/go/compat-checks@master + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: projectdiscovery/actions/setup/go/compat-checks@5ad9460589b729fcc7210fd809063a848ea407db # master with: go-version-file: 'go.mod' diff --git a/.github/workflows/dep-auto-merge.yml b/.github/workflows/dep-auto-merge.yml index 84b26e1fe..47823ab19 100644 --- a/.github/workflows/dep-auto-merge.yml +++ b/.github/workflows/dep-auto-merge.yml @@ -16,11 +16,11 @@ jobs: runs-on: ubuntu-latest if: github.actor == 'dependabot[bot]' steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 with: token: ${{ secrets.DEPENDABOT_PAT }} - - uses: ahmadnassri/action-dependabot-auto-merge@v2 + - uses: ahmadnassri/action-dependabot-auto-merge@45fc124d949b19b6b8bf6645b6c9d55f4f9ac61a # v2.6.6 with: github-token: ${{ secrets.DEPENDABOT_PAT }} target: all \ No newline at end of file diff --git a/.github/workflows/dockerhub-push.yml b/.github/workflows/dockerhub-push.yml index b540657d1..3669887fa 100644 --- a/.github/workflows/dockerhub-push.yml +++ b/.github/workflows/dockerhub-push.yml @@ -12,7 +12,7 @@ jobs: runs-on: ubuntu-latest-16-cores steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Get Github tag id: meta @@ -20,19 +20,19 @@ jobs: curl --silent "https://api.github.com/repos/projectdiscovery/httpx/releases/latest" | jq -r .tag_name | xargs -I {} echo TAG={} >> $GITHUB_OUTPUT - name: Set up QEMU - uses: docker/setup-qemu-action@v2 + uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2.2.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v2 + uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2.10.0 - name: Login to DockerHub - uses: docker/login-action@v2 + uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_TOKEN }} - name: Build and push - uses: docker/build-push-action@v4 + uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1 with: context: . platforms: linux/amd64,linux/arm64,linux/arm diff --git a/.github/workflows/functional-test.yml b/.github/workflows/functional-test.yml index f712dddae..67b86b805 100644 --- a/.github/workflows/functional-test.yml +++ b/.github/workflows/functional-test.yml @@ -16,9 +16,9 @@ jobs: os: [ubuntu-latest, windows-latest, macOS-latest] steps: - name: Check out code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - - uses: projectdiscovery/actions/setup/go@v1 + - uses: projectdiscovery/actions/setup/go@4ff2f2094e67bb1819a069aa130a49463ecaa3f3 # v1.29.4 - name: Functional Tests run: | diff --git a/.github/workflows/release-binary.yml b/.github/workflows/release-binary.yml index b906129db..b4039cd49 100644 --- a/.github/workflows/release-binary.yml +++ b/.github/workflows/release-binary.yml @@ -11,14 +11,14 @@ jobs: runs-on: ubuntu-latest-16-cores steps: - name: "Check out code" - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 - - uses: projectdiscovery/actions/setup/go@v1 + - uses: projectdiscovery/actions/setup/go@4ff2f2094e67bb1819a069aa130a49463ecaa3f3 # v1.29.4 - name: "Create release on GitHub" - uses: goreleaser/goreleaser-action@v4 + uses: goreleaser/goreleaser-action@5fdedb94abba051217030cc86d4523cf3f02243d # v4.6.0 with: args: "release --clean" version: latest diff --git a/.github/workflows/release-test.yml b/.github/workflows/release-test.yml index c163e9c72..4298904b5 100644 --- a/.github/workflows/release-test.yml +++ b/.github/workflows/release-test.yml @@ -12,14 +12,14 @@ jobs: runs-on: ubuntu-latest-16-cores steps: - name: "Check out code" - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 - - uses: projectdiscovery/actions/setup/go@v1 + - uses: projectdiscovery/actions/setup/go@4ff2f2094e67bb1819a069aa130a49463ecaa3f3 # v1.29.4 - name: release test - uses: goreleaser/goreleaser-action@v4 + uses: goreleaser/goreleaser-action@5fdedb94abba051217030cc86d4523cf3f02243d # v4.6.0 with: args: "release --clean --snapshot" version: latest diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml index 5254b32a0..eb9c6ffe5 100644 --- a/.github/workflows/stale.yaml +++ b/.github/workflows/stale.yaml @@ -13,7 +13,7 @@ jobs: issues: write pull-requests: write steps: - - uses: actions/stale@v9 + - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0 with: days-before-stale: 90 days-before-close: 7 From 5bb8ec5206e532b6f42cf635d7fa7d8c70a9240a Mon Sep 17 00:00:00 2001 From: Thibaud-Vdb Date: Mon, 10 Aug 2026 13:40:00 +0200 Subject: [PATCH 2/3] Declare token permissions on the test, docker and release workflows Five workflows ran with the repository's default token grants. Only the release workflow writes through the GitHub token, goreleaser creates the release and uploads the binaries, so it keeps contents write. The test and docker workflows drop to read only, the Docker Hub push authenticates with its own registry credentials and never needs the GitHub token. --- .github/workflows/build-test.yml | 3 +++ .github/workflows/dockerhub-push.yml | 3 +++ .github/workflows/functional-test.yml | 3 +++ .github/workflows/release-binary.yml | 4 ++++ .github/workflows/release-test.yml | 3 +++ 5 files changed, 16 insertions(+) diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml index d1808b45b..50e1f1ecd 100644 --- a/.github/workflows/build-test.yml +++ b/.github/workflows/build-test.yml @@ -7,6 +7,9 @@ on: - '**.mod' workflow_dispatch: +permissions: + contents: read + jobs: lint: name: Lint Test diff --git a/.github/workflows/dockerhub-push.yml b/.github/workflows/dockerhub-push.yml index 3669887fa..88a1dd68a 100644 --- a/.github/workflows/dockerhub-push.yml +++ b/.github/workflows/dockerhub-push.yml @@ -7,6 +7,9 @@ on: - completed workflow_dispatch: +permissions: + contents: read + jobs: docker: runs-on: ubuntu-latest-16-cores diff --git a/.github/workflows/functional-test.yml b/.github/workflows/functional-test.yml index 67b86b805..e415d2892 100644 --- a/.github/workflows/functional-test.yml +++ b/.github/workflows/functional-test.yml @@ -7,6 +7,9 @@ on: - '**.mod' workflow_dispatch: +permissions: + contents: read + jobs: functional: name: Functional Test diff --git a/.github/workflows/release-binary.yml b/.github/workflows/release-binary.yml index b4039cd49..ff25738c0 100644 --- a/.github/workflows/release-binary.yml +++ b/.github/workflows/release-binary.yml @@ -6,6 +6,10 @@ on: - '*' workflow_dispatch: +permissions: + # goreleaser creates the release and uploads the binaries. + contents: write + jobs: release: runs-on: ubuntu-latest-16-cores diff --git a/.github/workflows/release-test.yml b/.github/workflows/release-test.yml index 4298904b5..71f60ba71 100644 --- a/.github/workflows/release-test.yml +++ b/.github/workflows/release-test.yml @@ -7,6 +7,9 @@ on: - '**.mod' workflow_dispatch: +permissions: + contents: read + jobs: release-test: runs-on: ubuntu-latest-16-cores From 4b4208c0650963f26804118c0738029a3a19e8af Mon Sep 17 00:00:00 2001 From: Thibaud-Vdb Date: Mon, 10 Aug 2026 13:42:50 +0200 Subject: [PATCH 3/3] Move codeql-action off the advisory-affected v2 line The v2 releases from 2.26.11 on are in the range of GHSA-vqf5-2xx6-9wfm, the CodeQL debug artifacts could contain the GitHub PAT, and no fixed v2 release exists, the fix shipped in 3.28.3. The v2 line is also deprecated. This moves the three codeql-action references to the current release, pinned by SHA like the rest. --- .github/workflows/codeql-analysis.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 1369659ff..7b1d674d0 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -29,12 +29,12 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1 + uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 with: languages: ${{ matrix.language }} - name: Autobuild - uses: github/codeql-action/autobuild@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1 + uses: github/codeql-action/autobuild@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1 \ No newline at end of file + uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 \ No newline at end of file