Pinning GitHub Actions to Commit SHAs

Pinning GitHub Actions to their commit SHA addresses a significant security concern. By default, many GitHub Actions workflows utilize version tags such as @v1 or @latest. This convenient approach can be problematic when a maintainer's account is compromised, allowing an attacker to introduce malicious code under a trusted tag. As a result, a developer's CI/CD pipeline inadvertently pulls in potentially harmful code without any prior scrutiny.

A straightforward solution to avoid this risk is to pin actions to their exact commit SHA, rather than relying on mutable tags. Instead of using : actions/checkout@v4, for instance, the updated workflow would use : actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11, referring to the specific commit number (4.1.1) of the action.

While the action continues to perform the same function, pinning it to the commit SHA ensures that the code remains unchanged and cannot be retroactively altered. If the upstream repository is compromised or the tag is moved, the workflow will still operate with the previously audited commit. Several tools, like pin-github-action, can automate the conversion process for numerous workflows. Alternatively, developers can manually copy the SHA from the release page, which GitHub displays next to each tagged release.

The added verbosity may seem unnecessary, but it is a small price to pay for enhanced security. Developers are already diligent about reviewing dependency updates in their application code. Their CI pipelines, which have access to sensitive secrets and build artifacts, deserve the same level of scrutiny. By pinning actions to their commit SHA, developers can significantly reduce the risk of introducing malicious code into their systems.