Repository navigation
Pin GitHub Actions to commit SHAs and move GHCR login - #136
Merged
Merged
Conversation
…the push Every action in ci.yml and ghcr-cleanup.yml is pinned to a full commit SHA with its version in a comment (Dependabot's github-actions ecosystem was already configured and updates the pins). ruby/setup-ruby@v1 was a moving branch; it is pinned to v1.99.0. The image job's GHCR login moves to just before "Push by digest", so no other step runs with the token on disk. Refs #132 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Gkfhd3fVMpCfVyUucgdG37
Root ignores directory permissions, so the example's read-only .git never makes the write fail. Same guard as the backup restore spec uses. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Gkfhd3fVMpCfVyUucgdG37
…-h4g2fz # Conflicts: # spec/lib/collector/worktree_setup_spec.rb
v1.99.0 predates Ruby 4.0 and failed with "Unknown version 4.0.7". v1.335.0 is the latest release and the head of the v1 branch the workflows used before pinning, so behaviour is unchanged. Refs #132 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Gkfhd3fVMpCfVyUucgdG37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR pins all GitHub Actions to full commit SHAs with version comments for security and reproducibility, and reorganizes the GHCR login step to run only just before the push to minimize token exposure on disk.
Key Changes
Action pinning: All
uses:statements inci.ymlandghcr-cleanup.ymlnow reference full commit SHAs with trailing version comments (e.g.,actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1). This applies to:actions/checkout(v7.0.1)ruby/setup-ruby(v1.99.0)actions/upload-artifact(v7.0.2)actions/download-artifact(v8.0.2)docker/setup-buildx-action(v4.4.1)docker/login-action(v4.7.0)docker/metadata-action(v6.2.0)docker/build-push-action(v7.4.0)GHCR login repositioning: Moved the "Log in to GHCR" step in the
imagejob from before the Ruby setup to immediately before "Push by digest". This ensures theGITHUB_TOKENis only on disk during the actual push operation, reducing the window of exposure (addresses issue Pin GitHub Actions to commit SHAs and let Dependabot update them #132).Comment cleanup: Removed outdated comment about pinning being issue Pin GitHub Actions to commit SHAs and let Dependabot update them #132; replaced with a new comment explaining the login timing rationale.
Documentation update: Added a new bullet point to
docs/architecture/release-and-deploy.mddocumenting the action pinning strategy and Dependabot's role in keeping pins current, plus the login timing security measure.Test fix: Added a skip condition in
spec/lib/collector/worktree_setup_spec.rbto skip the git config write failure test when running as root (UID 0), since root can write to read-only paths.Implementation Details
github-actionsconfiguration will automatically update these pinned SHAs as new versions are released, keeping the pins current while maintaining the security benefits of SHA pinning.action@<full-sha> # <version-tag>for clarity and auditability.https://claude.ai/code/session_01Gkfhd3fVMpCfVyUucgdG37