From 4f0e783b4d6f2a48ea00f76bbf474ab59c9fdf23 Mon Sep 17 00:00:00 2001 From: AnzalKhan16 Date: Sun, 2 Aug 2026 15:13:58 +0530 Subject: [PATCH] ci: Pin GitHub Actions to immutable commit SHAs --- .github/workflows/catalog-sync-check.yml | 4 +- .github/workflows/check-artifacts.yml | 2 +- .github/workflows/ci.yml | 52 ++++++++++---------- .github/workflows/docker-hardening.yml | 16 +++--- .github/workflows/plugin-integrity-check.yml | 4 +- .github/workflows/security-ci.yml | 26 +++++----- .github/workflows/smoke-test.yml | 10 ++-- .github/workflows/trivy-scan.yml | 26 +++++----- 8 files changed, 70 insertions(+), 70 deletions(-) diff --git a/.github/workflows/catalog-sync-check.yml b/.github/workflows/catalog-sync-check.yml index e108764ed..1de6db328 100644 --- a/.github/workflows/catalog-sync-check.yml +++ b/.github/workflows/catalog-sync-check.yml @@ -12,10 +12,10 @@ jobs: steps: - name: Checkout Repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: '3.11' diff --git a/.github/workflows/check-artifacts.yml b/.github/workflows/check-artifacts.yml index 7f520594d..711ec87d1 100644 --- a/.github/workflows/check-artifacts.yml +++ b/.github/workflows/check-artifacts.yml @@ -16,7 +16,7 @@ jobs: artifact-check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: fetch-depth: 0 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d6ed9d78b..b38c446b5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,11 +14,11 @@ jobs: run_backend: ${{ steps.filter.outputs.run_backend }} run_frontend: ${{ steps.filter.outputs.run_frontend }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: fetch-depth: 0 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: "3.11" - name: Fetch base branch for diff @@ -37,7 +37,7 @@ jobs: if: github.event_name == 'pull_request' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: fetch-depth: 0 - name: Check formatting hygiene on changed files @@ -46,8 +46,8 @@ jobs: issue-template-label-validation: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: "3.11" - name: Validate issue template labels @@ -56,8 +56,8 @@ jobs: doc-anchor-validation: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: "3.11" @@ -69,8 +69,8 @@ jobs: if: needs.detect-changes.outputs.run_backend == 'true' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: "3.11" - name: Install backend system dependencies @@ -91,8 +91,8 @@ jobs: (needs.formatting-hygiene.result == 'success' || needs.formatting-hygiene.result == 'skipped') runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: "3.11" - name: Install backend system dependencies @@ -113,8 +113,8 @@ jobs: (needs.formatting-hygiene.result == 'success' || needs.formatting-hygiene.result == 'skipped') runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: "3.11" - name: Install backend system dependencies @@ -142,8 +142,8 @@ jobs: - credentials - exploit steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: "3.11" - name: Install backend system dependencies @@ -173,8 +173,8 @@ jobs: backend-audit: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: "3.11" - name: Install backend system dependencies @@ -207,13 +207,13 @@ jobs: - name: Upload pip-audit report if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: pip-audit-report path: ${{ github.workspace }}/backend/pip-audit-report.json - name: Upload SBOM - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: sbom path: ${{ github.workspace }}/sbom.json @@ -222,8 +222,8 @@ jobs: runs-on: ubuntu-latest needs: [backend-lint] steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: "3.11" - name: Install backend system dependencies @@ -238,7 +238,7 @@ jobs: continue-on-error: true - name: Upload benchmark comparison artifacts if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: benchmark-threshold-comparison path: | @@ -263,8 +263,8 @@ jobs: run: working-directory: frontend steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: ${{ matrix.node-version }} cache: "npm" @@ -276,7 +276,7 @@ jobs: echo "version=$PLAYWRIGHT_VERSION" >> "$GITHUB_OUTPUT" echo "Using Playwright version $PLAYWRIGHT_VERSION for browser cache key" - name: Restore Playwright browser cache - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 with: path: ~/.cache/ms-playwright key: ${{ runner.os }}-playwright-${{ steps.playwright-version.outputs.version }}-${{ matrix.node-version }} @@ -302,7 +302,7 @@ jobs: run: python ${{ github.workspace }}/scripts/check_npm_audit.py --report ${{ github.workspace }}/frontend/npm-audit-report.json --config ${{ github.workspace }}/.audit-config.yaml - name: Upload npm-audit report if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: npm-audit-report path: frontend/npm-audit-report.json diff --git a/.github/workflows/docker-hardening.yml b/.github/workflows/docker-hardening.yml index 412c7c763..d9005de6b 100644 --- a/.github/workflows/docker-hardening.yml +++ b/.github/workflows/docker-hardening.yml @@ -34,13 +34,13 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Build ${{ matrix.service }} image - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 with: context: ${{ matrix.context }} file: ${{ matrix.dockerfile }} @@ -54,7 +54,7 @@ jobs: run: docker save ${{ matrix.image }}:ci -o /tmp/${{ matrix.image }}.tar - name: Upload image artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: ${{ matrix.image }}-tar path: /tmp/${{ matrix.image }}.tar @@ -75,10 +75,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Download image artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: ${{ matrix.image }}-tar path: /tmp @@ -114,7 +114,7 @@ jobs: # No secrets baked into image - name: Scan image layers for secrets (Trivy secret scanner) - uses: aquasecurity/trivy-action@v0.36.0 + uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0 with: image-ref: ${{ matrix.image }}:ci format: table @@ -124,7 +124,7 @@ jobs: # Dockerfile lint (hadolint) - name: Lint ${{ matrix.service }} Dockerfile with hadolint - uses: hadolint/hadolint-action@v3.1.0 + uses: hadolint/hadolint-action@54c9adbab1582c2ef04b2016b760714a4bfde3cf # v3.1.0 with: dockerfile: ./${{ matrix.service }}/Dockerfile failure-threshold: error diff --git a/.github/workflows/plugin-integrity-check.yml b/.github/workflows/plugin-integrity-check.yml index 66160744b..e8fa58c9e 100644 --- a/.github/workflows/plugin-integrity-check.yml +++ b/.github/workflows/plugin-integrity-check.yml @@ -14,10 +14,10 @@ jobs: steps: - name: Checkout Repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: '3.11' diff --git a/.github/workflows/security-ci.yml b/.github/workflows/security-ci.yml index 8abb80e22..278829abb 100644 --- a/.github/workflows/security-ci.yml +++ b/.github/workflows/security-ci.yml @@ -15,8 +15,8 @@ jobs: name: Python Security Linting (Bandit) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: "3.11" - name: Install bandit @@ -39,7 +39,7 @@ jobs: " - name: Upload bandit report if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: bandit-report path: bandit-report.json @@ -48,8 +48,8 @@ jobs: name: Route Authentication Check runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: "3.11" - name: Check all API routers have authentication @@ -82,8 +82,8 @@ jobs: name: Debug Mode Default Check runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: "3.11" - name: Verify debug mode is off by default @@ -124,7 +124,7 @@ jobs: name: Hardcoded Secret Detection runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: fetch-depth: 0 - name: Scan for hardcoded secrets @@ -172,8 +172,8 @@ jobs: name: Environment Config Validation runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: "3.11" - name: Validate .env.example safe defaults @@ -205,8 +205,8 @@ jobs: name: Dependency Security Audit runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: "3.11" - name: Install pip-audit @@ -234,7 +234,7 @@ jobs: " - name: Upload audit report if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: dep-audit-report path: dep-audit.json diff --git a/.github/workflows/smoke-test.yml b/.github/workflows/smoke-test.yml index 491a16a19..84e221f97 100644 --- a/.github/workflows/smoke-test.yml +++ b/.github/workflows/smoke-test.yml @@ -33,7 +33,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Validate start.sh syntax run: bash -n start.sh @@ -58,20 +58,20 @@ jobs: steps: # ── 1. Checkout ──────────────────────────────────────────────────────── - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 # ── 2. Set up Python 3.11 ────────────────────────────────────────────── # setup.sh requires Python 3.11+. We pin it explicitly so the runner # never silently falls back to an older system Python. - name: Set up Python 3.11 - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: "3.11" # ── 3. Set up Node.js ────────────────────────────────────────────────── # setup.sh checks for node + npm; frontend uses Vite on port 5173. - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: "20" @@ -224,7 +224,7 @@ jobs: # ── 13. Upload logs on failure ───────────────────────────────────────── - name: Upload logs on failure if: failure() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: smoke-test-logs path: | diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml index 492576a02..1c66df11e 100644 --- a/.github/workflows/trivy-scan.yml +++ b/.github/workflows/trivy-scan.yml @@ -44,13 +44,13 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Build ${{ matrix.service }} image - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 with: context: ${{ matrix.context }} file: ${{ matrix.dockerfile }} @@ -64,7 +64,7 @@ jobs: run: docker save ${{ matrix.image }}:ci -o /tmp/${{ matrix.image }}.tar - name: Upload image artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: ${{ matrix.image }}-tar path: /tmp/${{ matrix.image }}.tar @@ -85,10 +85,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Download image artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: ${{ matrix.image }}-tar path: /tmp @@ -97,7 +97,7 @@ jobs: run: docker load -i /tmp/${{ matrix.image }}.tar - name: Run Trivy - table output - uses: aquasecurity/trivy-action@v0.36.0 + uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0 with: image-ref: ${{ matrix.image }}:ci format: table @@ -107,7 +107,7 @@ jobs: severity: CRITICAL,HIGH - name: Run Trivy - SARIF report - uses: aquasecurity/trivy-action@v0.36.0 + uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0 with: image-ref: ${{ matrix.image }}:ci format: sarif @@ -117,14 +117,14 @@ jobs: severity: CRITICAL,HIGH - name: Upload SARIF to GitHub Security - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@47be0dbd5113ab1b79fe2dd3f68bdf7e426cdc87 # v3 if: always() with: sarif_file: trivy-${{ matrix.service }}.sarif category: trivy-${{ matrix.service }} - name: Run Trivy - JSON report - uses: aquasecurity/trivy-action@v0.36.0 + uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0 with: image-ref: ${{ matrix.image }}:ci format: json @@ -134,14 +134,14 @@ jobs: severity: CRITICAL,HIGH - name: Upload JSON vulnerability report - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: trivy-report-${{ matrix.service }} path: trivy-${{ matrix.service }}.json retention-days: 30 - name: Fail on CRITICAL vulnerabilities - uses: aquasecurity/trivy-action@v0.36.0 + uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0 with: image-ref: ${{ matrix.image }}:ci format: table @@ -161,7 +161,7 @@ jobs: - name: Trivy scan of vulnerable image - expect non-zero exit id: vuln_scan continue-on-error: true - uses: aquasecurity/trivy-action@v0.36.0 + uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0 with: image-ref: python:3.8.20-slim-bullseye format: table