I Pinned 31 GitHub Actions to Commit SHAs. One Major Tag Was Two Versions Stale.
Yesterday I pinned 31 GitHub Actions to commit SHAs for a set of workflows I was packaging. Every SHA was resolved from the upstream repository rather than copied from a README or a tutorial, and the process turned up three things worth writing down — including one action whose v3 major tag is two full major versions behind its newest release. Here is how to pin correctly, without the API and…
Yesterday, the author pinned 31 GitHub Actions to their respective commit SHAs. This process revealed three important findings. First, a major tag that is two versions behind its latest release. The action actions/dependency-review-action@v3 points to a commit without a v3.x.y release tag, indicating that the newest release is v5.0.0.
The pin should be set to v5.0.0 instead. Second, a major tag that lags behind its own releases. The action sigstore/cosign-installer@v3 points to v3.9.1, while the latest release is v4.1.2. Users should be aware that a major tag does not guarantee access to the latest major version. Third, certain projects lack major tags altogether.
In the case of aquasecurity/trivy-action, the workflow uses @master, which is pinned to a branch. This is less desirable than pinning to a tag. The author provides a script that can quickly resolve commit SHAs for various actions, making the pinning process faster and easier. The author emphasizes that pinning is just one component of a strong security posture, and they also recommend implementing least-privilege permissions and following additional best practices.
The author has compiled all of this information into a product called the GitHub Actions Production Workflow Vault, which costs $19.99 and includes detailed documentation and verification methods.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
