security: pin dependencies and restrict token permissions#90
security: pin dependencies and restrict token permissions#90djach7 wants to merge 1 commit intocontainers:mainfrom
Conversation
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #90 +/- ##
=======================================
Coverage 79.19% 79.19%
=======================================
Files 10 10
Lines 1115 1115
=======================================
Hits 883 883
Misses 134 134
Partials 98 98 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
I don't disagree with the pinning of the actions, but I just want to understand how we would handle updating them in the future. Dependabot has made this easier in the past with their auto-generated PRs; can the behavior of dependabot be changed to use digests instead of tags? |
|
Sorry @miabbott I missed this comment. From my understanding (and what I've learned grilling claude about this) dependabot should maintain whatever format is in the file. So after this PR is merged all future dependabot PRs should switch to using digests as well. |
|
|
||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@v4 | ||
| uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4 |
There was a problem hiding this comment.
The pinned SHA 95e58e9a... corresponds to v4.35.2, but the latest v4 patch is v4.35.3 (e46ed2cb...). Was v4.35.2 pinned intentionally, or would it make sense to update to v4.35.3, please?
There was a problem hiding this comment.
I would replace v4.35.3 with v4 so that comments regarding versions are consistent.
| os: [ ubuntu-latest, ubuntu-24.04-arm] | ||
| container: | ||
| image: quay.io/fedora/fedora:latest | ||
| image: quay.io/fedora/fedora@sha256:3de521d4e5fdfd9a368063f0d628dff2a0162f5d1cede0ceeefcd4465dd43a40 # latest |
There was a problem hiding this comment.
I just want to point out that the pinned SHA will probably not stay up-to-date for long. From what I have been able to find, Dependabot does not currently support updating container image digests in GitHub Actions workflow files (see issue 5819). It has been recommended to use Renovate to keep this digest current. What do you think about it, please?
There was a problem hiding this comment.
You're right, do you think it makes sense to sacrifice however much OpenSSF score it is and go back to latest? The other option is to use renovate and set that up, I don't know much about it though.
There was a problem hiding this comment.
Renovate is starting to see wider adoption within Red Hat, so it may be worth a spike to see if we could use it as a replacement for dependabot.
For the current container image setting, it may be more obvious to use a versioned tag (i.e. :43 or :44) rather than :latest. It won't appease OpenSSF, but would be more descriptive about what version is being used to build the software.
There was a problem hiding this comment.
I think the version tag is a good compromise, I think we'll still get some credit from OpenSSF for that too. I'll push an update with that change.
There was a problem hiding this comment.
@djach7, do you plan to create a spike to find out more information about Renovate or do you want me to create it, please?
knecasov
left a comment
knecasov
left a comment
There was a problem hiding this comment.
I added a few comments.
|
@knecasov thanks for reviewing! I just pushed an update addressing your comments and I resolved the ones that were comment or hash updates. I left the digest one open in case we want to have more discussion there. |
Pin all GitHub Actions to commit SHAs and container images to digests
to prevent supply chain attacks. Add explicit permissions blocks to
workflows following principle of least privilege.
Changes:
- Pin actions/checkout, actions/setup-go, codecov/codecov-action,
actions/create-github-app-token, cycjimmy/semantic-release-action,
goreleaser/goreleaser-action, and github/codeql-action to commit SHAs
- Pin quay.io/fedora/fedora container image to sha256 digest
- Add workflow-level "contents: read" permission to ci.yml and security.yml
- Add job-level "contents: write" permission to version-release job
These changes address OpenSSF Scorecard findings:
- Pinned-Dependencies: 0/10 -> 10/10
- Token-Permissions: 0/10 -> 10/10
- Expected overall score improvement: 6.8/10 -> ~8.0/10
Related: THEEDGE-4717
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Signed-off-by: djach7 <djachimo@redhat.com>
3 participants
Pin all GitHub Actions to commit SHAs and container images to digests
to prevent supply chain attacks. Add explicit permissions blocks to
workflows following principle of least privilege.
Changes:
These changes address OpenSSF Scorecard findings:
Related: THEEDGE-4717
Co-Authored-By: Claude Sonnet 4.5 noreply@anthropic.com