Title: fix: pin 10 unpinned action(s) by dagecko · Pull Request #146485 · python/cpython · GitHub
Open Graph Title: fix: pin 10 unpinned action(s) by dagecko · Pull Request #146485 · python/cpython
X Title: fix: pin 10 unpinned action(s) by dagecko · Pull Request #146485 · python/cpython
Description: Security: Harden GitHub Actions workflows Hey, we found some CI/CD security issues in this repo's workflows using Runner Guard, our open-source CI/CD security scanner at Vigilant. These are the same vulnerability classes being actively exploited right now in the tj-actions, Trivy, LiteLLM supply chain attack chain. We scanned the top 50K repos on GitHub and over 20,000 have this same problem. We're trying to get fixes out to as many maintainers as possible before more repos get hit. This PR fixes what we could automatically, and flags anything else that needs a manual look. There's a real person behind this PR, we're actively checking back on comments so if you have any questions just drop them here and we'll respond. Fixes applied (in this PR) Rule Severity File Description RGS-007 high .github/workflows/build.yml Pinned 1 third-party action(s) to commit SHA RGS-007 high .github/workflows/documentation-links.yml Pinned 1 third-party action(s) to commit SHA RGS-007 high .github/workflows/lint.yml Pinned 1 third-party action(s) to commit SHA RGS-007 high .github/workflows/require-pr-label.yml Pinned 4 third-party action(s) to commit SHA RGS-007 high .github/workflows/reusable-cifuzz.yml Pinned 2 third-party action(s) to commit SHA RGS-007 high .github/workflows/reusable-wasi.yml Pinned 1 third-party action(s) to commit SHA Advisory: additional findings (manual review recommended) | Rule | Severity | File | Description | | RGS-006 | high | .github/workflows/jit.yml | Curl-Pipe-Bash Remote Code Execution | | RGS-006 | high | .github/workflows/jit.yml | Curl-Pipe-Bash Remote Code Execution | | RGS-006 | high | .github/workflows/reusable-ubuntu.yml | Curl-Pipe-Bash Remote Code Execution | | RGS-006 | high | .github/workflows/tail-call.yml | Curl-Pipe-Bash Remote Code Execution | | RGS-005 | medium | .github/workflows/documentation-links.yml | Excessive Permissions on Untrusted Trigger | Why this matters GitHub Actions workflows that use untrusted input in run: blocks, expose secrets inline, or use unpinned third-party actions are vulnerable to code injection, credential theft, and supply chain attacks. These are the same vulnerability classes exploited in the tj-actions/changed-files incident and subsequent supply chain attacks, which compromised CI secrets across thousands of repositories. How to verify Review the diff — each change is mechanical and preserves workflow behavior: SHA pinning (RGS-007): Pins third-party actions to immutable commit SHAs (original version tag preserved as comment) Run brew install Vigilant-LLC/tap/runner-guard && runner-guard scan . or install from the repo to verify. Found by Runner Guard | Built by Vigilant Cyber Security | Learn more If this PR is not welcome, just close it -- we won't send another.
Open Graph Description: Security: Harden GitHub Actions workflows Hey, we found some CI/CD security issues in this repo's workflows using Runner Guard, our open-source CI/CD security scanner at Vigilant. These are the...
X Description: Security: Harden GitHub Actions workflows Hey, we found some CI/CD security issues in this repo's workflows using Runner Guard, our open-source CI/CD security scanner at Vigilant. These are...
Opengraph URL: https://github.com/python/cpython/pull/146485
X: @github
Domain: github.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:9347664f-8878-0584-0ed2-ed58bd5b0662 |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | A3FC:550E0:B8BF96:F625B1:6A56AC20 |
| html-safe-nonce | 99294197431e72101119d99d0fa471b498a85f337f8afd8a0b407f527c61b72c |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJBM0ZDOjU1MEUwOkI4QkY5NjpGNjI1QjE6NkE1NkFDMjAiLCJ2aXNpdG9yX2lkIjoiODQ0NDk0NTYyNDY3NjYwOTA1NiIsInJlZ2lvbl9lZGdlIjoiaWFkIiwicmVnaW9uX3JlbmRlciI6ImlhZCJ9 |
| visitor-hmac | 002f1b9a384463a17714c51fd27e4306f67613851d03fb992422b7391599e924 |
| hovercard-subject-tag | pull_request:3453423839 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/python/cpython/pull/146485/files |
| twitter:image | https://avatars.githubusercontent.com/u/6371704?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/u/6371704?s=400&v=4 |
| og:image:alt | Security: Harden GitHub Actions workflows Hey, we found some CI/CD security issues in this repo's workflows using Runner Guard, our open-source CI/CD security scanner at Vigilant. These are the... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | 13efe7fe8ecc41eda1078cbde8206041ed92bc54e29bcb737e9353dd9c407aad |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/python/cpython git https://github.com/python/cpython.git |
| octolytics-dimension-user_id | 1525981 |
| octolytics-dimension-user_login | python |
| octolytics-dimension-repository_id | 81598961 |
| octolytics-dimension-repository_nwo | python/cpython |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 81598961 |
| octolytics-dimension-repository_network_root_nwo | python/cpython |
| turbo-body-classes | logged-out env-production page-responsive full-width |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | 5466ebe023a0abf876a1e6c5d7602ee8f5e6a02b |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width