Repository navigation
ci: pin every action to a commit SHA, and BuildKit to a digest - #152
Merged
Merged
Conversation
The release-docker build jobs log in with the read/write DOCKERHUB_TOKEN, yet ran actions by floating major tag (@v4, @v7), so whoever could move a tag could run code holding that token. Every `uses:` in every workflow now names a full commit SHA with its release as a trailing comment, matching the setup-qemu-action pin. Each SHA is the commit the major tag pointed at when pinned, resolved with `gh api .../git/ref/tags/<tag>` and with the annotated tags (action-gh-release, codeql-action, claude-code-action) dereferenced, so the code that runs today is unchanged. setup-buildx-action also pins its BuildKit image to moby/buildkit:v0.33.1@sha256:cec9f139..., the release buildx-stable-1 (the action's default) points at now; it carries the 2026-09-30 BuildKit advisory fixes. Dependabot's existing github-actions entry keeps the SHA pins and their comments moving. It now groups them into one PR and waits a week after a release (cooldown) before proposing it. The BuildKit and binfmt digests are outside Dependabot's reach and are noted as manual bumps.
…roup for docker/* `sbom: true` made BuildKit run docker/buildkit-syft-scanner:stable-1, a moving Docker Hub tag, inside both release builds. The generator is now named by digest (1.12.0, which is what stable-1 resolves to today), so the SBOM attestation published with applegater/* comes from a fixed scanner. setup-qemu-action restored the privileged binfmt image from the Actions cache and fell back to that copy when a pull failed; cache-image: false makes the digest pin the only source. The header no longer claims nothing in these jobs can change: the runner's own docker/buildx and the Dockerfiles' base images are outside the pins. It also says how to hand-bump the three image digests and check that each vX.Y.Z tag matches its digest. Dependabot gives the docker/* actions, which run with the Docker Hub token, a PR of their own.
…bot group; per-image bump table actions/checkout runs first in both token-holding jobs, before login, so its bumps now come in the same PR as the docker/* actions. The hand-bump note lists each image's moving tag next to the versioned tag to write, since binfmt (qemu-vX.Y.Z) and the SBOM scanner (X.Y.Z, no v) do not follow moby/buildkit's vX.Y.Z.
GITHUB_REF_NAME is the tag on a release (v2.68.6, unchanged) but the branch name on a manual workflow_dispatch run. A branch like ci/pin-actions put a / in the archive name, so mkdir created a nested directory and the following tar -C dist could not find it. Replace / with - in the version used for file names only.
X4Applegate
force-pushed
the
ci/pin-actions
branch
from
October 26, 2026 03:02
3b9b597 to
e7bc864
Compare
X4Applegate
marked this pull request as ready for review
October 26, 2026 03:02
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft: needs Richard's go-ahead before merge.
What
The release-docker build jobs log in with the read/write
DOCKERHUB_TOKEN, so anyone who could move a floating@v4/@v7tag could run code holding that token. This PR pins everything those jobs name:uses:in.github/workflows/*.yml(26 lines, 7 files) now names a full commit SHA with a trailing# vX.Y.Z. This is the same form as the existingdocker/setup-qemu-actionpin.setup-buildx-actionpins its image withdriver-opts: image=moby/buildkit:v0.33.1@sha256:cec9f139….sbom: trueused to rundocker/buildkit-syft-scanner:stable-1, a moving tag, inside the release BuildKit. It is nowsbom: generator=docker.io/docker/buildkit-syft-scanner:1.12.0@sha256:ae4f3b55….setup-qemu-actiongetscache-image: false, so the privileged binfmt image always comes from its digest pin and never from the Actions cache fallback.3d3c42e5…b7ad1dad…cf430e03…f87e5991…81c6f93d…c3c9e263…99012661…(already pinned)efb35369…(annotated tag, dereferenced)9b325408…(annotated tag, dereferenced)925afb53…(annotated tag, dereferenced)Each pinned SHA is the commit the major tag pointed at today, and each pinned image digest is what the moving tag resolves to today (
buildx-stable-1,stable-1). So the code that runs is the same as before.Every SHA is on the upstream default branch, not a fork-only commit, and is signed. BuildKit v0.33.1 contains the 2026-09-30 advisory fixes.
Dependabot
The existing
github-actionsentry now has a 7-daycooldown. Security updates are not delayed by it. It also has two groups:release-actions(docker/*andactions/checkout, the actions that run in the jobs holding the Hub token) gets its own PR, and everything else is batched into a second PR.Dependabot rewrites the SHA and its
# vX.Y.Zcomment together. It does not touch the three image digests; the release-docker.yml header explains how to bump those by hand.Verification
zizmor --offline:unpinned-useswent from 25 findings to 0.actionlint: no new findings; one info-level SC2035 in release-binaries.yml was already there.push=false,caddy=true): 40223037957 for 4e2aed8 and 40224529506 for 72b5987. 3b9b597 changes only comments in the workflow and the Dependabot groups. The logs show the pinned SHAs being downloaded and the pinned BuildKit digest being pulled.Rollback
git revertthe three commits. Nothing outside.github/changes.