Repository navigation
Conversation
These steps run with repository secrets (CACHIX_PRIVATE_KFB_TOKEN, CACHIX_PUBLIC_TOKEN, PYPI_TOKEN) or fetch executables consumed by later steps, but were referenced through mutable tags or an unpinned flake ref: - `workflow/nix-shell-action@v3.3.2` -> pinned to 10ebd4e8 (`v3.3.2`) - `workflow/nix-shell-action@v3` -> pinned to 608eb204 (current `v3` commit) - `pypa/gh-action-pypi-publish@release/v1` -> pinned to 7245906f (`release/v1`) - `github:runtimeverification/kup` -> pinned to rev 063314a7 Pinning to commit SHAs prevents a moved tag or a compromised upstream from silently changing what runs in a release job with publish credentials. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Author
|
Tagging @tothtamas28 for review, per CONTRIBUTING.md. The four pinned SHAs were re-verified against the upstream refs ( |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pins the three third-party references that run in secret-bearing release steps to immutable commit SHAs, plus the
kupflake input used by the installer.Changes (
.github/workflows/release.yml)workflow/nix-shell-action@v3.3.2@10ebd4e80eae8a5bc5147c0a36ebb568d1b277bd # v3.3.2workflow/nix-shell-action@v3@608eb20401e12c82b204e8e2c6a8b0eebfb5407c # v3pypa/gh-action-pypi-publish@release/v1@7245906fb61fa33a13554f9d5fb856fe61758086 # release/v1github:runtimeverification/kupgithub:runtimeverification/kup/063314a75a3af900dbab864f4d5845fba2206e64Rationale
These steps handle
CACHIX_PRIVATE_KFB_TOKEN,CACHIX_PUBLIC_TOKEN, andPYPI_TOKEN(or feed executables consumed by later steps). Referencing them through mutable tags or a moving flake ref means an upstream compromise or an accidental tag move silently changes what executes in a publishing job — the pattern behind CVE-2025-30066 intj-actions/changed-files. Pinning to SHAs removes that path; the tag is kept in a trailing comment for dependabot-style readability.Broader pinning of the remaining actions (checkout, setup-java, artifact actions, cachix actions, etc.) is left out of this change to keep it minimal, but is worth doing separately.
Validation
actionlint .github/workflows/release.ymlreports no new findings on the changed lines (the only diagnostic is a pre-existing composite-action metadata warning on./.github/actions/with-k-docker, unrelated to this change).