Skip to content

Commit cd172f9

Browse files
jalsethjalseth
committed
ci: Pin GitHub Actions to the Git SHA using ratchet
This improves security by not trusting Git tags which can be updated behind the scenes to inject malicious code without any changes to conftest or its workflows. Signed-off-by: James Alseth <[email protected]>
1 parent 7d41238 commit cd172f9

File tree

4 files changed

+73
-63
lines changed

4 files changed

+73
-63
lines changed

‎.github/workflows/pr.yaml‎

Lines changed: 56 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -10,51 +10,56 @@ env:
1010
PLATFORMS: linux/amd64,linux/arm64
1111

1212
jobs:
13-
style:
13+
lint:
1414
runs-on: ubuntu-latest
1515
steps:
16-
- name: checkout all PR branch and commits
17-
uses: actions/checkout@v5
18-
with:
19-
ref: ${{ github.event.pull_request.head.sha }}
20-
fetch-depth: ${{ github.event.pull_request.commits }}
21-
22-
- name: setup go
23-
uses: actions/setup-go@v6
24-
with:
25-
go-version: "1.25.x"
26-
cache: false
27-
28-
- name: validate conventional commit prefix
29-
working-directory: scripts
30-
run: ./validate-conventional-commit-prefix.sh
31-
32-
- name: golangci-lint
33-
uses: golangci/golangci-lint-action@v8
34-
with:
35-
args: --timeout=5m --color=always --max-same-issues=0 --max-issues-per-linter=0
36-
37-
- name: setup regal
38-
uses: StyraInc/setup-regal@v1
39-
with:
40-
version: v0.30
41-
42-
- name: lint examples - warnings
43-
continue-on-error: true # Regal returns non-zero even with fail-level set to warning.
44-
run: >-
45-
regal lint
46-
examples
47-
--disable directory-package-mismatch
48-
--disable unresolved-import
49-
--format github
50-
51-
- name: lint examples - blocking
52-
run: >-
53-
regal lint
54-
examples
55-
--disable-all
56-
--enable-category bugs
57-
--format github
16+
- name: checkout all PR branch and commits
17+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # ratchet:actions/checkout@v5
18+
with:
19+
ref: ${{ github.event.pull_request.head.sha }}
20+
fetch-depth: ${{ github.event.pull_request.commits }}
21+
22+
- name: setup go
23+
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # ratchet:actions/setup-go@v6
24+
with:
25+
go-version: "1.25.x"
26+
cache: false
27+
28+
- name: validate conventional commit prefix
29+
working-directory: scripts
30+
run: ./validate-conventional-commit-prefix.sh
31+
32+
- name: golangci-lint
33+
uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # ratchet:golangci/golangci-lint-action@v8
34+
with:
35+
args: --timeout=5m --color=always --max-same-issues=0 --max-issues-per-linter=0
36+
37+
- name: setup regal
38+
uses: StyraInc/setup-regal@33a142b1189004e0f14bf42b15972c67eecce776 # ratchet:StyraInc/setup-regal@v1
39+
with:
40+
version: v0.30
41+
42+
- name: lint examples - warnings
43+
continue-on-error: true # Regal returns non-zero even with fail-level set to warning.
44+
run: >-
45+
regal lint
46+
examples
47+
--disable directory-package-mismatch
48+
--disable unresolved-import
49+
--format github
50+
51+
- name: lint examples - blocking
52+
run: >-
53+
regal lint
54+
examples
55+
--disable-all
56+
--enable-category bugs
57+
--format github
58+
59+
- name: ratchet
60+
uses: sethvargo/ratchet@main
61+
with:
62+
files: .github/workflows
5863

5964
validate:
6065
strategy:
@@ -66,10 +71,10 @@ jobs:
6671
runs-on: ${{ matrix.os }}
6772
steps:
6873
- name: checkout source
69-
uses: actions/checkout@v5
74+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # ratchet:actions/checkout@v5
7075

7176
- name: setup go
72-
uses: actions/setup-go@v6
77+
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # ratchet:actions/setup-go@v6
7378
with:
7479
go-version: "1.25.x"
7580
cache: false
@@ -83,13 +88,13 @@ jobs:
8388
# Ensure Actions runner has Python installed
8489
# This is required for pre-commit tests to work
8590
- name: setup python
86-
uses: actions/setup-python@v6
91+
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # ratchet:actions/setup-python@v6
8792
with:
8893
python-version: '3.13'
8994
cache: 'pip'
9095

9196
- name: setup bats
92-
uses: bats-core/[email protected]
97+
uses: bats-core/bats-action@42fcc8700f773c075a16a90eb11674c0318ad507 # ratchet:bats-core/bats-action@3.0.1
9398
with:
9499
# Pin bats version to fix CI issue: https://github.com/bats-core/bats-action/pull/4
95100
bats-version: "1.10.0"
@@ -129,13 +134,13 @@ jobs:
129134
- validate
130135
steps:
131136
- name: checkout source
132-
uses: actions/checkout@v5
137+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # ratchet:actions/checkout@v5
133138

134139
- name: setup docker buildx
135140
run: docker buildx create --name conftestbuild --use
136141

137142
- name: Build Docker image
138-
uses: docker/build-push-action@v6
143+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # ratchet:docker/build-push-action@v6
139144
with:
140145
context: .
141146
push: false
@@ -152,13 +157,13 @@ jobs:
152157
- validate
153158
steps:
154159
- name: checkout source
155-
uses: actions/checkout@v5
160+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # ratchet:actions/checkout@v5
156161

157162
- name: setup docker buildx
158163
run: docker buildx create --name conftestbuild --use
159164

160165
- name: Build Docker image
161-
uses: docker/build-push-action@v6
166+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # ratchet:docker/build-push-action@v6
162167
with:
163168
context: .
164169
target: examples

‎.github/workflows/release.yaml‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,13 @@ jobs:
1515
contents: read
1616
steps:
1717
- name: checkout source
18-
uses: actions/checkout@v5
18+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # ratchet:actions/checkout@v5
1919

2020
# It is important to check the GoReleaser config before pushing to
2121
# Dockerhub to avoid having mismatches between what is in Dockerhub
2222
# and GitHub releases.
2323
- name: check releaser config
24-
uses: goreleaser/goreleaser-action@v6
24+
uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # ratchet:goreleaser/goreleaser-action@v6
2525
with:
2626
args: check
2727
version: "~> v1"
@@ -34,10 +34,10 @@ jobs:
3434
- check
3535
steps:
3636
- name: checkout source
37-
uses: actions/checkout@v5
37+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # ratchet:actions/checkout@v5
3838

3939
- name: login to docker hub
40-
uses: docker/login-action@v3
40+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # ratchet:docker/login-action@v3
4141
with:
4242
username: ${{ secrets.DOCKER_LOGIN }}
4343
password: ${{ secrets.DOCKER_PASSWORD }}
@@ -50,7 +50,7 @@ jobs:
5050
run: docker buildx create --name conftestbuild --use
5151

5252
- name: Build and push Docker image
53-
uses: docker/build-push-action@v6
53+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # ratchet:docker/build-push-action@v6
5454
with:
5555
context: .
5656
push: true
@@ -69,10 +69,10 @@ jobs:
6969
- check
7070
steps:
7171
- name: checkout source
72-
uses: actions/checkout@v5
72+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # ratchet:actions/checkout@v5
7373

7474
- name: login to docker hub
75-
uses: docker/login-action@v3
75+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # ratchet:docker/login-action@v3
7676
with:
7777
username: ${{ secrets.DOCKER_LOGIN }}
7878
password: ${{ secrets.DOCKER_PASSWORD }}
@@ -81,13 +81,13 @@ jobs:
8181
run: docker buildx create --name conftestbuild --use
8282

8383
- name: Build and push examples image
84-
uses: docker/build-push-action@v6
84+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # ratchet:docker/build-push-action@v6
8585
with:
8686
context: .
8787
push: true
8888
target: examples
8989
tags: ${{ env.IMAGE }}:examples
90-
platforms: ${{ env.PLATFORMS }}
90+
platforms: ${{ env.PLATFORMS }}
9191

9292
goreleaser:
9393
runs-on: ubuntu-latest
@@ -98,17 +98,17 @@ jobs:
9898
- docker-examples
9999
steps:
100100
- name: checkout source
101-
uses: actions/checkout@v5
101+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # ratchet:actions/checkout@v5
102102
with:
103103
fetch-depth: 0 # Need to fetch the full history for the GoReleaser changelog.
104104

105105
- name: setup go
106-
uses: actions/setup-go@v6
106+
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # ratchet:actions/setup-go@v6
107107
with:
108108
go-version: "1.25.x"
109109

110110
- name: release
111-
uses: goreleaser/goreleaser-action@v6
111+
uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # ratchet:goreleaser/goreleaser-action@v6
112112
with:
113113
args: release --clean
114114
version: "~> v1"

‎Makefile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,10 @@ test-oci: ## Runs the OCI integration test for push and pull.
5656
lint: ## Lints Conftest.
5757
@golangci-lint run --fix
5858

59+
.PHONY: ratchet-update
60+
ratchet-update:
61+
@find .github/workflows -path "*.yaml" -exec ratchet update {} \;
62+
5963
.PHONY: all
6064
all: lint build test test-examples test-acceptance ## Runs all linting and tests.
6165

‎flake.nix‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
golangci-lint
2323
gnumake
2424
pre-commit
25+
ratchet
2526
regal
2627
];
2728
};

0 commit comments

Comments
 (0)