Skip to content

[release/v7.4.15] [StepSecurity] ci: Harden GitHub Actions tags #27243

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
daxian-dbw wants to merge 1 commit into from
Closed

[release/v7.4.15] [StepSecurity] ci: Harden GitHub Actions tags #27243

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/actions/build/ci/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ runs:
if: github.event_name != 'PullRequest'
run: Write-Host "##vso[build.updatebuildnumber]$env:BUILD_SOURCEBRANCHNAME-$env:BUILD_SOURCEVERSION-$((get-date).ToString("yyyyMMddhhmmss"))"
shell: pwsh
- uses: actions/setup-dotnet@v4
- uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
with:
global-json-file: ./global.json
- name: Bootstrap
Expand All @@ -34,7 +34,7 @@ runs:
Invoke-CIBuild
shell: pwsh
- name: Upload build artifact
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: build
path: ${{ runner.workspace }}/build
2 changes: 1 addition & 1 deletion .github/actions/infrastructure/get-changed-files/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ runs:
steps:
- name: Get changed files
id: get-files
uses: actions/github-script@v7
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
with:
script: |
const eventTypes = '${{ inputs.event-types }}'.split(',').map(t => t.trim());
Expand Down
2 changes: 1 addition & 1 deletion .github/actions/infrastructure/path-filters/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ runs:

- name: Check if GitHubWorkflowChanges is present
id: filter
uses: actions/github-script@v7.0.1
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
env:
FILES_JSON: ${{ steps.get-files.outputs.files }}
with:
Expand Down
8 changes: 4 additions & 4 deletions .github/actions/test/linux-packaging/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ runs:
Show-Environment
shell: pwsh

- uses: actions/setup-dotnet@v5
- uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
with:
global-json-file: ./global.json

Expand Down Expand Up @@ -97,21 +97,21 @@ runs:
shell: pwsh

- name: Upload deb packages
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: packages-deb
path: ${{ runner.workspace }}/packages/*.deb
if-no-files-found: ignore
Comment on lines 99 to 104

Copilot AI Apr 9, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file pins upload-artifact, but it still uses an unpinned tag (actions/download-artifact@v4) earlier in the workflow. Since the PR goal is to harden/pin action refs, consider pinning the download-artifact reference to an immutable SHA as well for consistency.

Copilot uses AI. Check for mistakes.

- name: Upload rpm packages
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: packages-rpm
path: ${{ runner.workspace }}/packages/*.rpm
if-no-files-found: ignore

- name: Upload tar.gz packages
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: packages-tar
path: ${{ runner.workspace }}/packages/*.tar.gz
Expand Down
6 changes: 3 additions & 3 deletions .github/actions/test/nix/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ runs:
shell: pwsh

- name: Download Build Artifacts
uses: actions/download-artifact@v4
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
with:
path: "${{ github.workspace }}"

Expand All @@ -39,7 +39,7 @@ runs:
Write-LogGroupEnd -Title 'Artifacts Directory'
shell: pwsh

- uses: actions/setup-dotnet@v4
- uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
with:
global-json-file: ./global.json

Expand All @@ -53,7 +53,7 @@ runs:
Write-LogGroupEnd -Title 'Bootstrap'

- name: Extract Files
uses: actions/github-script@v7.0.0
uses: actions/github-script@e69ef5462fd455e02edcaf4dd7708eda96b9eda0 # v7.0.0
env:
DESTINATION_FOLDER: "${{ github.workspace }}/bins"
ARCHIVE_FILE_PATTERNS: "${{ github.workspace }}/build/build.zip"
Expand Down
2 changes: 1 addition & 1 deletion .github/actions/test/process-pester-results/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ runs:

- name: Upload testResults artifact
if: always()
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: junit-pester-${{ inputs.name }}
path: ${{ runner.workspace }}/testResults
4 changes: 2 additions & 2 deletions .github/actions/test/windows/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ runs:
shell: pwsh

- name: Download Build Artifacts
uses: actions/download-artifact@v4
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
with:
path: "${{ github.workspace }}"

Expand All @@ -39,7 +39,7 @@ runs:
Write-LogGroupEnd -Title 'Artifacts Directory'
shell: pwsh

- uses: actions/setup-dotnet@v4
- uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
with:
global-json-file: .\global.json

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/analyze-reusable.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ jobs:
with:
fetch-depth: '0'

- uses: actions/setup-dotnet@v5
- uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
with:
global-json-file: ./global.json

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/copilot-setup-steps.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ jobs:
# You can define any steps you want, and they will run before the agent starts.
# If you do not check out your code, Copilot will do this for you.
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 1000

Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/labels.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,11 +18,11 @@ jobs:

steps:
- name: Check out the repository
uses: actions/checkout@v2
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Verify PR has label starting with 'cl-'
id: verify-labels
uses: actions/github-script@v6
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
with:
script: |
const labels = context.payload.pull_request.labels.map(label => label.name.toLowerCase());
Expand Down
45 changes: 19 additions & 26 deletions .github/workflows/linux-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,8 @@ on:
- github-mirror
paths:
- "**"
- "*"
- ".globalconfig"
- "!.github/ISSUE_TEMPLATE/**"
- "!.dependabot/config.yml"
- "!.pipelines/**"
Expand All @@ -25,12 +27,12 @@ on:
# Path filters for PRs need to go into the changes job

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
cancel-in-progress: ${{ contains(github.ref, 'merge')}}

env:
DOTNET_CLI_TELEMETRY_OPTOUT: 1
DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1
DOTNET_NOLOGO: 1
FORCE_FEATURE: 'False'
FORCE_PACKAGE: 'False'
NUGET_KEY: none
Expand All @@ -55,7 +57,7 @@ jobs:
packagingChanged: ${{ steps.filter.outputs.packagingChanged }}
steps:
- name: checkout
uses: actions/checkout@v4
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false

Expand All @@ -74,7 +76,7 @@ jobs:
contents: read
steps:
- name: checkout
uses: actions/checkout@v5
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Check for merge conflict markers
uses: "./.github/actions/infrastructure/merge-conflict-checker"
Expand All @@ -86,7 +88,7 @@ jobs:
if: ${{ needs.changes.outputs.source == 'true' || needs.changes.outputs.buildModuleChanged == 'true' }}
steps:
- name: checkout
uses: actions/checkout@v4.1.0
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 1000

Expand All @@ -101,14 +103,15 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: checkout
uses: actions/checkout@v4.1.0
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 1000
- name: Linux Unelevated CI
uses: "./.github/actions/test/nix"
with:
purpose: UnelevatedPesterTests
tagSet: CI
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Comment on lines 110 to +114

Copilot AI Apr 9, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

./.github/actions/test/nix doesn't declare a GITHUB_TOKEN input (it only defines purpose, tagSet, ctrfFolder). Passing GITHUB_TOKEN here will be treated as an unexpected/ignored input and can generate warnings; remove it or add a declared input in the composite action and plumb it through to the steps that need it.

Copilot uses AI. Check for mistakes.
linux_test_elevated_ci:
name: Linux Elevated CI
needs:
Expand All @@ -118,14 +121,15 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: checkout
uses: actions/checkout@v4.1.0
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 1000
- name: Linux Elevated CI
uses: "./.github/actions/test/nix"
with:
purpose: ElevatedPesterTests
tagSet: CI
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Comment on lines 128 to +132

Copilot AI Apr 9, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

./.github/actions/test/nix doesn't declare a GITHUB_TOKEN input (it only defines purpose, tagSet, ctrfFolder). Passing GITHUB_TOKEN here will be treated as an unexpected/ignored input and can generate warnings; remove it or add a declared input in the composite action and plumb it through to the steps that need it.

Copilot uses AI. Check for mistakes.
linux_test_unelevated_others:
name: Linux Unelevated Others
needs:
Expand All @@ -135,14 +139,15 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: checkout
uses: actions/checkout@v4.1.0
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 1000
- name: Linux Unelevated Others
uses: "./.github/actions/test/nix"
with:
purpose: UnelevatedPesterTests
tagSet: Others
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Comment on lines 146 to +150

Copilot AI Apr 9, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

./.github/actions/test/nix doesn't declare a GITHUB_TOKEN input (it only defines purpose, tagSet, ctrfFolder). Passing GITHUB_TOKEN here will be treated as an unexpected/ignored input and can generate warnings; remove it or add a declared input in the composite action and plumb it through to the steps that need it.

Copilot uses AI. Check for mistakes.
linux_test_elevated_others:
name: Linux Elevated Others
needs:
Expand All @@ -152,42 +157,31 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: checkout
uses: actions/checkout@v4.1.0
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 1000
- name: Linux Elevated Others
uses: "./.github/actions/test/nix"
with:
purpose: ElevatedPesterTests
tagSet: Others
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Comment on lines 164 to +168

Copilot AI Apr 9, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

./.github/actions/test/nix doesn't declare a GITHUB_TOKEN input (it only defines purpose, tagSet, ctrfFolder). Passing GITHUB_TOKEN here will be treated as an unexpected/ignored input and can generate warnings; remove it or add a declared input in the composite action and plumb it through to the steps that need it.

Copilot uses AI. Check for mistakes.
xunit_tests:
name: xUnit Tests
needs:
- changes
if: ${{ needs.changes.outputs.source == 'true' }}
if: ${{ needs.changes.outputs.source == 'true' || needs.changes.outputs.buildModuleChanged == 'true' }}
uses: ./.github/workflows/xunit-tests.yml
with:
runner_os: ubuntu-latest
test_results_artifact_name: testResults-xunit

analyze:
name: CodeQL Analysis
needs: changes
if: ${{ needs.changes.outputs.source == 'true' }}
uses: ./.github/workflows/analyze-reusable.yml
permissions:
actions: read
contents: read
security-events: write
with:
runner_os: ubuntu-latest

infrastructure_tests:
name: Infrastructure Tests
runs-on: ubuntu-latest
steps:
- name: checkout
uses: actions/checkout@v5
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 1

Expand Down Expand Up @@ -245,24 +239,23 @@ jobs:
- linux_test_elevated_others
- linux_test_unelevated_ci
- linux_test_unelevated_others
- analyze
- linux_packaging
- merge_conflict_check
- infrastructure_tests
# - analyze
Comment on lines 241 to +245

Copilot AI Apr 9, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ready_to_merge no longer depends on the Linux CodeQL analyze job (it's commented out). This is a functional/security behavior change, but the PR description says the edits are limited to action ref pinning and preserve workflow behavior. Please confirm whether CodeQL is intended to be disabled on Linux in this backport; if so, update the PR description and ensure there’s a tracked follow-up to re-enable it, otherwise restore the job/dependency.

Copilot uses AI. Check for mistakes.
if: always()
uses: PowerShell/compliance/.github/workflows/ready-to-merge.yml@v1.0.0
with:
needs_context: ${{ toJson(needs) }}
linux_packaging:
name: Linux Packaging
needs:
- ci_build
- changes
if: ${{ needs.changes.outputs.packagingChanged == 'true' }}
runs-on: ubuntu-latest
steps:
- name: checkout
uses: actions/checkout@v5
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
- name: Linux Packaging
Expand Down
Loading
Loading