security: pin kubescape/github-action to a full commit SHA#253
Open
kobihikri wants to merge 1 commit into
Open
security: pin kubescape/github-action to a full commit SHA#253kobihikri wants to merge 1 commit into
kobihikri wants to merge 1 commit into
Conversation
The Docker Image Scanners workflow logs in to ghcr.io with GITHUB_TOKEN before running the image scanners, so any action in this job runs with a credentialed Docker session. kubescape/github-action is still referenced by the mutable `@main` branch, which means the exact code that runs in that credentialed context can change without any change to this template. This is the same hardening applied to trivy-action in ory#247 (after master briefly pointed to a malicious version, CVE-2026-33634). Pinning to a full commit SHA closes the same class of risk for kubescape. 7d90c1f159f02df1e3c79f839eeabe42ea30d4e3 is the commit `@main` resolves to today (2026-06-01), so behaviour is unchanged — the ref is just fixed in place. Regenerating the downstream repos propagates the pin to kratos, hydra, keto and the other server repos.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe CVE scanning workflow updates the Kubescape GitHub Action reference from the ChangesCVE scan workflow
Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
|
Author
|
recheck |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Pin
kubescape/github-actionin thecve-scan.yamlserver template to a full commit SHA instead of the mutable@mainbranch.Why
In the
Docker Image Scannersjob, the runner logs in toghcr.iowith${{ secrets.GITHUB_TOKEN }}before the scanners run. Every subsequent step — includingkubescape/github-action— therefore executes with a credentialed Docker session on the runner. Because that action is referenced by the moving@mainbranch, the exact code that runs in that credentialed context can change at any time without any change in this repository.This is the same class of risk, in the same workflow, that #247 addressed for
trivy-actionaftermasterbriefly pointed to a malicious version (CVE-2026-33634).kubescape/github-action@mainis the one third-party action here still on a branch ref, so this applies the same known-good hardening to it.Behaviour
7d90c1f159f02df1e3c79f839eeabe42ea30d4e3is the commit@mainresolves to today (2026-06-01), so this pins to exactly what already runs — nothing about current behaviour changes, the ref is just fixed in place.I deliberately did not pin to the latest release tag:
v3.0.21is from 2024-11 andmainis ~18 months ahead of it, so pinning to the tag would silently roll those changes back. Pinning to current@mainHEAD keeps behaviour identical. If you'd rather track a release,v3.0.21=c9749b84d138c0cbbb702b258774954f5463b82e— happy to switch to whichever you prefer.Because this is the template, regenerating propagates the pin to the downstream server repos (kratos, hydra, keto, …).
Notes
I used AI assistance to review the workflow and draft this change; I read and verified every line myself and take responsibility for it. I understand this needs the Ory CLA and will sign it. Thank you for maintaining Ory — glad to adjust or close if you'd prefer a different approach.
Summary by CodeRabbit