From 2594cddbff96d8bd9e75ca1821157868ed2ebf4b Mon Sep 17 00:00:00 2001 From: Patrick Kaeding Date: Mon, 23 Mar 2026 23:23:26 -0400 Subject: [PATCH] [SEC-7924] chore: pin third-party GitHub Actions to commit SHAs Pin all third-party GitHub Actions to full-length commit SHAs to prevent supply chain attacks. Addresses findings from the third-party-action-not-pinned-to-commit-sha Semgrep rule. --- .github/actions/publish-android-sdk/action.yml | 2 +- .github/workflows/devskim.yml | 2 +- .github/workflows/dotnet.yml | 2 +- .github/workflows/elixir-sdk.yml | 8 ++++---- .github/workflows/go-sdk.yml | 4 ++-- .github/workflows/java-sdk.yml | 2 +- .github/workflows/python-plugin.yml | 4 ++-- .github/workflows/python.yml | 4 ++-- .github/workflows/ruby.yml | 8 ++++---- .github/workflows/rust-sdk.yml | 8 ++++---- sdk/highlight-php/.github/workflows/ci.yml | 4 ++-- 11 files changed, 24 insertions(+), 24 deletions(-) diff --git a/.github/actions/publish-android-sdk/action.yml b/.github/actions/publish-android-sdk/action.yml index 1787f3264b..0a405914f7 100644 --- a/.github/actions/publish-android-sdk/action.yml +++ b/.github/actions/publish-android-sdk/action.yml @@ -39,7 +39,7 @@ runs: java-version: ${{ inputs.java_version }} - name: Setup Android SDK - uses: android-actions/setup-android@v3 + uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3 - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0 name: Get secrets diff --git a/.github/workflows/devskim.yml b/.github/workflows/devskim.yml index 2a8e1acd8b..051b0ddf2d 100644 --- a/.github/workflows/devskim.yml +++ b/.github/workflows/devskim.yml @@ -25,7 +25,7 @@ jobs: token: ${{ secrets.GITHUB_TOKEN }} - name: Run DevSkim scanner - uses: microsoft/DevSkim-Action@v1 + uses: microsoft/DevSkim-Action@4b5047945a44163b94642a1cecc0d93a3f428cc6 # v1 with: ignore-globs: '**/otel/samples/**' diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml index d21202151e..82c58ec072 100644 --- a/.github/workflows/dotnet.yml +++ b/.github/workflows/dotnet.yml @@ -56,7 +56,7 @@ jobs: dotnet-version: 8.x - name: Setup dotnet - uses: microsoft/setup-msbuild@v2 + uses: microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce # v2 - name: msbuild restore run: msbuild -t:Restore diff --git a/.github/workflows/elixir-sdk.yml b/.github/workflows/elixir-sdk.yml index e4aef7a397..54aae8e3a1 100644 --- a/.github/workflows/elixir-sdk.yml +++ b/.github/workflows/elixir-sdk.yml @@ -24,7 +24,7 @@ jobs: with: token: ${{ secrets.GITHUB_TOKEN }} - name: Setup Elixir - uses: erlef/setup-beam@v1 + uses: erlef/setup-beam@ee09b1e59bb240681c382eb1f0abc6a04af72764 # v1 with: elixir-version: ${{ env.ELIXIR_VERSION }} otp-version: ${{ env.OTP_VERSION }} @@ -41,7 +41,7 @@ jobs: with: token: ${{ secrets.GITHUB_TOKEN }} - name: Setup Elixir - uses: erlef/setup-beam@v1 + uses: erlef/setup-beam@ee09b1e59bb240681c382eb1f0abc6a04af72764 # v1 with: elixir-version: ${{ env.ELIXIR_VERSION }} otp-version: ${{ env.OTP_VERSION }} @@ -63,12 +63,12 @@ jobs: with: token: ${{ secrets.GITHUB_TOKEN }} - name: Setup Elixir - uses: erlef/setup-beam@v1 + uses: erlef/setup-beam@ee09b1e59bb240681c382eb1f0abc6a04af72764 # v1 with: elixir-version: ${{ env.ELIXIR_VERSION }} otp-version: ${{ env.OTP_VERSION }} - name: Publish to Hex - uses: synchronal/hex-publish-action@v3 + uses: synchronal/hex-publish-action@2e73c1e570ae96dcfe548b498df7c8c1942a3100 # v3 with: name: highlight key: ${{ secrets.HEX_PM_KEY }} diff --git a/.github/workflows/go-sdk.yml b/.github/workflows/go-sdk.yml index 542b05f988..4745e87769 100644 --- a/.github/workflows/go-sdk.yml +++ b/.github/workflows/go-sdk.yml @@ -25,7 +25,7 @@ jobs: go-version-file: './sdk/highlight-go/go.mod' cache-dependency-path: './sdk/highlight-go/go.sum' - name: Format - uses: Jerome1337/gofmt-action@v1.0.5 + uses: Jerome1337/gofmt-action@d5eabd189843f1d568286a54578159978b7c0fb1 # v1.0.5 with: gofmt-path: './sdk/highlight-go' gofmt-flags: '-l -d' @@ -44,7 +44,7 @@ jobs: go-version-file: './sdk/highlight-go/go.mod' cache-dependency-path: './sdk/highlight-go/go.sum' - name: Run linter - uses: golangci/golangci-lint-action@v6.4.1 + uses: golangci/golangci-lint-action@818ec4d51a1feacefc42ff1b3ec25d4962690f39 # v6.4.1 with: args: -v --config ./.golangci.yaml working-directory: sdk/highlight-go diff --git a/.github/workflows/java-sdk.yml b/.github/workflows/java-sdk.yml index 91d14c0e7f..303c550dbd 100644 --- a/.github/workflows/java-sdk.yml +++ b/.github/workflows/java-sdk.yml @@ -152,7 +152,7 @@ jobs: retention-days: 1 - name: Publish Test Report - uses: mikepenz/action-junit-report@v4 + uses: mikepenz/action-junit-report@db71d41eb79864e25ab0337e395c352e84523afe # v4 with: commit: ${{github.event.workflow_run.head_sha}} report_paths: '**/target/surefire-reports/TEST-*.xml' diff --git a/.github/workflows/python-plugin.yml b/.github/workflows/python-plugin.yml index 33f398bd76..63247c0b9b 100644 --- a/.github/workflows/python-plugin.yml +++ b/.github/workflows/python-plugin.yml @@ -33,7 +33,7 @@ jobs: python-version: '3.10' - name: Install poetry - uses: abatilo/actions-poetry@7b6d33e44b4f08d7021a1dee3c044e9c253d6439 + uses: abatilo/actions-poetry@7b6d33e44b4f08d7021a1dee3c044e9c253d6439 # 7b6d33e44b4f08d7021a1dee3c044e9c253d6439 - run: make install - name: Lint @@ -42,7 +42,7 @@ jobs: run: make test - name: Get Cover if: github.event_name == 'pull_request' - uses: orgoro/coverage@v3 + uses: orgoro/coverage@d77626a5fa35d39123e86d6c62907fabe2491496 # v3 with: coverageFile: ./sdk/@launchdarkly/observability-python/coverage.xml token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml index 4b4e469b5e..97f1fee565 100644 --- a/.github/workflows/python.yml +++ b/.github/workflows/python.yml @@ -40,7 +40,7 @@ jobs: run: poetry run pytest --cov=highlight_io --cov-branch --cov-report xml - name: Get Cover if: github.event_name == 'pull_request' - uses: orgoro/coverage@v3 + uses: orgoro/coverage@d77626a5fa35d39123e86d6c62907fabe2491496 # v3 with: coverageFile: ./sdk/highlight-py/coverage.xml token: ${{ secrets.GITHUB_TOKEN }} @@ -53,7 +53,7 @@ jobs: python -m piptools compile --upgrade pyproject.toml; - name: Publish if: github.ref == 'refs/heads/main' - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1 with: packages-dir: ./sdk/highlight-py/dist/ skip-existing: true diff --git a/.github/workflows/ruby.yml b/.github/workflows/ruby.yml index 08aa688882..c622192fea 100644 --- a/.github/workflows/ruby.yml +++ b/.github/workflows/ruby.yml @@ -24,14 +24,14 @@ jobs: - uses: actions/checkout@v4 with: token: ${{ secrets.GITHUB_TOKEN }} - - uses: dorny/paths-filter@v2 + - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2 id: filter with: filters: | ruby-changed: - 'sdk/highlight-ruby/**' - name: Install Ruby - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1 with: ruby-version: ${{ matrix.ruby }} bundler-cache: true # runs 'bundle install' and caches installed gems automatically @@ -63,7 +63,7 @@ jobs: with: token: ${{ secrets.GITHUB_TOKEN }} - name: Install Ruby - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1 with: ruby-version: '3.3.4' bundler-cache: true # runs 'bundle install' and caches installed gems automatically @@ -84,7 +84,7 @@ jobs: with: token: ${{ secrets.GITHUB_TOKEN }} - name: Install Ruby - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1 with: ruby-version: '3.3.4' bundler-cache: true # runs 'bundle install' and caches installed gems automatically diff --git a/.github/workflows/rust-sdk.yml b/.github/workflows/rust-sdk.yml index 696c582d55..86e219d816 100644 --- a/.github/workflows/rust-sdk.yml +++ b/.github/workflows/rust-sdk.yml @@ -29,13 +29,13 @@ jobs: token: ${{ secrets.GITHUB_TOKEN }} - name: Install Rust toolchain - uses: actions-rs/toolchain@v1 + uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1 with: toolchain: stable override: true - name: Build crates - uses: katyo/publish-crates@v2 + uses: katyo/publish-crates@02cc2f1ad653fb25c7d1ff9eb590a8a50d06186b # v2 with: path: ./sdk/highlight-rust/ dry-run: true @@ -53,13 +53,13 @@ jobs: token: ${{ secrets.GITHUB_TOKEN }} - name: Install Rust toolchain - uses: actions-rs/toolchain@v1 + uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1 with: toolchain: stable override: true - name: Publish crates - uses: katyo/publish-crates@v2 + uses: katyo/publish-crates@02cc2f1ad653fb25c7d1ff9eb590a8a50d06186b # v2 with: path: ./sdk/highlight-rust/ registry-token: ${{ secrets.CARGO_REGISTRY_TOKEN }} diff --git a/sdk/highlight-php/.github/workflows/ci.yml b/sdk/highlight-php/.github/workflows/ci.yml index 3f9c586a90..7ecfda8d28 100644 --- a/sdk/highlight-php/.github/workflows/ci.yml +++ b/sdk/highlight-php/.github/workflows/ci.yml @@ -16,7 +16,7 @@ jobs: uses: actions/checkout@v4 - name: Install PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2 with: coverage: "none" extensions: "opentelemetry" @@ -24,7 +24,7 @@ jobs: tools: composer - name: Install Dependencies - uses: ramsey/composer-install@v2 + uses: ramsey/composer-install@1919f6c305aea6ab10e6181a8ddf72317ad77e0e # v2 with: composer-options: "--ansi --no-interaction --no-progress --prefer-dist"