security: harden CI workflows with SHA-pinned actions and dep-guard#130
Open
buger wants to merge 1 commit into
Open
security: harden CI workflows with SHA-pinned actions and dep-guard#130buger wants to merge 1 commit into
buger wants to merge 1 commit into
Conversation
…guard - Pin all GitHub Actions `uses:` references to full SHA-256 commit hashes - Pin TykTechnologies/github-actions refs to d3fa20888fa2878e877e22bb7702141217290e7c (main) - Pin TykTechnologies/jira-linter to 38a9cabef56171c4e52ea698fa7be3db5fca3a49 (main) - Pin probelabs/visor to 02e893ad11b66319b0fca1a43622038171c1a159 (main) - Add dep-guard job using TykTechnologies reusable dependency-guard workflow - Add `needs: [dep-guard]` to all build/test jobs in ci-tests.yml - Add `labeled` to pull_request event types across all PR-triggered workflows - Pin `go install github.com/wadey/gocovmerge` to commit SHA (b5bfa59e) - Add TODO comment for tykio/ci-tools Docker image digest pinning Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
CLA Assistant Lite bot: I have read the CLA Document and I hereby sign the CLA You can retrigger this bot by commenting recheck in this Pull Request |
🚨 Jira Linter FailedCommit: The Jira linter failed to validate your PR. Please check the error details below: 🔍 Click to view error detailsNext Steps
This comment will be automatically deleted once the linter passes. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
uses:to SHA-256: Every GitHub Action reference across all 4 workflows (ci-tests.yml,cla.yml,jira-pr-validator.yaml,visor.yaml) is now pinned to a full 40-character commit SHA instead of mutable tags/branches.dep-guardjob usingTykTechnologies/github-actions/.github/workflows/dependency-guard.ymlreusable workflow withcontents: readpermissions. All build jobs (golangci-lint,test,sonar-cloud-analysis) haveneeds: [dep-guard]to gate on dependency guard passing.labeledtrigger: Allpull_requestevent types now includelabeledto support label-driven workflows.go installto commit SHA:gocovmerge@latestchanged togocovmerge@b5bfa59ec0adc420475f97f89b58045c721d761c.# TODO: pin to digest once availablecomment fortykio/ci-tools:latest(digest not resolvable from CI).Actions pinned
actions/checkout34e114876b0b11c390a56381ad16ebd13914f8d5actions/upload-artifactea165f8d65b6e75b540449e92b4886f43607fa02actions/download-artifactd3f86a106a0bac45b974a628896c90dbdf5c8093actions/setup-gobe3c94b385c4f180051c996d336f57a34c397495actions/setup-go40f1582b2485089dde7abd97c1529aa768e1baffgolangci/golangci-lint-action4afd733a84b1f43292c63897423277bb7f4313a9arduino/setup-taske26d8975574116b0097a1161e0fe16ba75d84c1candstor/file-existence-actionf02338908d150e00a4b8bebc2dad18bd9e5229b0shrink/actions-docker-extract921bf17c6693530407a79458546c735d712a3216sonarsource/sonarcloud-github-actionba3875ecf642b2129de2b589510c81a8b53dbf4econtributor-assistant/github-actionb2a7f9fb90217ea0b8a0c95c288221457be4a31fTykTechnologies/github-actionsd3fa20888fa2878e877e22bb7702141217290e7cTykTechnologies/jira-linter38a9cabef56171c4e52ea698fa7be3db5fca3a49probelabs/visor02e893ad11b66319b0fca1a43622038171c1a159Test plan
dep-guardjob runs and passes on PRgolangci-lintjob waits fordep-guardbefore runningtestjob waits for bothdep-guardandgolangci-lintsonar-cloud-analysiswaits fordep-guard,test, andgolangci-lintlabeledevent type triggers workflows on label addition🤖 Generated with Claude Code