ci: pin vedantmgoyal9/winget-releaser to a SHA (v2) instead of @main#4162
ci: pin vedantmgoyal9/winget-releaser to a SHA (v2) instead of @main#4162kobihikri wants to merge 1 commit into
Conversation
The winget publish job passes WINGET_TOKEN (a PAT) to a third-party action pinned to the mutable @main branch. Pin to the v2 release commit so a force-move/compromise of that branch can't run with the token.
|
We are we only doing this for this specific workflow, but not for all? Specifically, I guess the correct approach would be to add a zizmor workflow as done in my personal repositories, which enforces such aspects, but only updating one case when there are plenty more similar usages sounds incomplete/wrong. |
|
You're right, and thanks — that's fair. I pinned just this workflow because it was the only third-party action on a moving branch ( Your zizmor idea sounds like a much better, more durable fix — a linter that enforces this across every workflow rather than hand-pinning one at a time. I'm not deeply familiar with zizmor yet, though — would you have a reference or an example setup you'd recommend I follow? If it's welcome, I'm glad to open a PR adding a zizmor workflow, and either fold this winget pin into it or close this PR in favor of it — whichever you prefer. |
2 participants
What this does
.github/workflows/winget.ymlruns the third-party actionvedantmgoyal9/winget-releaser@mainin the release-publish job that holdssecrets.WINGET_TOKEN(a PAT for winget-pkgs submissions). This pins it to thev2release commit instead of the moving@mainbranch:Why
@mainresolves to whatever that branch's HEAD is at run time. If it were force-moved or compromised (the class of thing that happened withtj-actions/changed-filesin 2025), the injected code would run withWINGET_TOKENin scope. Every other third-party action in the repo's workflows is already tag-pinned — this was the one on a mutable branch. Pinning to the SHA of thev2release keeps behavior identical while making updates deliberate.One-line change. I confirmed
4ffc788is the commit thev2release tag points to.Disclosure: I used an AI tool to help spot this and prepare the change; I verified the workflow and the pinned SHA myself and take responsibility for it.