Security: pin GitHub Actions to SHA hashes#61
Conversation
Replaces mutable tag/branch references with immutable SHA hashes to prevent supply chain attacks (ref: TeamPCP/Trivy March 2026). Actions left as tags: 0
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
This PR implements security hardening by pinning GitHub Actions to immutable SHA-1 hashes, which is aligned with security best practices; Codacy quality standards are met. However, a critical logic bug was identified in .github/workflows/comment_issue.yml where incorrect variable scoping in if conditions prevents steps from executing. Additionally, there is a recurring discrepancy across all files where actions/github-script is pinned to a SHA for v3.1.0 while being labeled as v2.0.0 in the comments. These issues must be addressed to ensure the workflows function correctly and remain maintainable.
About this PR
- Systemic inconsistency detected: The SHA hash used for
actions/github-script(6e5ee1d...) corresponds to versionv3.1.0, but the inline comments label it asv2.0.0. Please ensure the SHA and the version tag in the comment are synchronized to the intended version.
Test suggestions
- Verify 'Comment issue on Jira' workflow executes successfully with pinned actions
- Verify 'Create issue on Jira' workflow executes successfully with pinned actions
- Verify 'Create issue on Jira when labeled' workflow executes successfully with pinned actions
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify 'Comment issue on Jira' workflow executes successfully with pinned actions
2. Verify 'Create issue on Jira' workflow executes successfully with pinned actions
3. Verify 'Create issue on Jira when labeled' workflow executes successfully with pinned actions
🗒️ Improve review quality by adding custom instructions
| if: env.JIRA_CREATE_COMMENT_AUTO == 'true' && env.GITHUB_ISSUE_TYPE == 'issue' && env.GITHUB_ISSUE_HAS_JIRA_ISSUE_LABEL == 'true' | ||
| id: login | ||
| uses: atlassian/gajira-login@v2.0.0 | ||
| uses: atlassian/gajira-login@90a599561baaf8c05b080645ed73db7391c246ed # v2.0.0 |
There was a problem hiding this comment.
🔴 HIGH RISK
The if condition for this step relies on env.GITHUB_ISSUE_TYPE and env.GITHUB_ISSUE_HAS_JIRA_ISSUE_LABEL, which are not defined in the job-level environment. Consequently, this step will never execute. Use step outputs directly in the condition.
| - name: Change Title | ||
| if: github.event.label.name == env.JIRA_ISSUE_LABEL | ||
| uses: actions/github-script@v2.0.0 | ||
| uses: actions/github-script@6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 # v2.0.0 |
There was a problem hiding this comment.
🟡 MEDIUM RISK
The SHA hash 6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 belongs to v3.1.0. To pin to v2.0.0 as specified in the comment, use the correct SHA.
| uses: actions/github-script@6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 # v2.0.0 | |
| uses: actions/github-script@76387de5877f864e405d45d31139454174312781 # v2.0.0 |
| - name: Update GitHub issue | ||
| if: env.JIRA_CREATE_ISSUE_AUTO == 'true' | ||
| uses: actions/github-script@v2.0.0 | ||
| uses: actions/github-script@6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 # v2.0.0 |
There was a problem hiding this comment.
🟡 MEDIUM RISK
The SHA hash 6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 belongs to v3.1.0. To pin to v2.0.0 as specified in the comment, use the correct SHA.
| uses: actions/github-script@6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 # v2.0.0 | |
| uses: actions/github-script@76387de5877f864e405d45d31139454174312781 # v2.0.0 |
| if: env.JIRA_CREATE_COMMENT_AUTO == 'true' | ||
| id: github_issue_type | ||
| uses: actions/github-script@v2.0.0 | ||
| uses: actions/github-script@6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 # v2.0.0 |
There was a problem hiding this comment.
🟡 MEDIUM RISK
The SHA hash 6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 belongs to v3.1.0. To strictly pin to v2.0.0 as specified in the comment, use the correct SHA.
| uses: actions/github-script@6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 # v2.0.0 | |
| uses: actions/github-script@76387de5877f864e405d45d31139454174312781 # v2.0.0 |
2 participants
Pins all GitHub Actions from mutable tags/branches to immutable SHA hashes.
This prevents supply chain attacks like the TeamPCP/Trivy incident (March 2026), where attackers force-pushed tags to point at malicious commits.
Auto-generated by the Codacy security audit script.