From 48f123ce724f664afb7088823a95002436772fde Mon Sep 17 00:00:00 2001 From: Pim Feltkamp <48278217+pimfeltkamp@users.noreply.github.com> Date: Mon, 9 Nov 2026 00:54:33 +0100 Subject: [PATCH] Security: pin release workflow actions to commit SHAs and Bun to 1.4.4 cli-release.yml runs with NPM_TOKEN, contents:write and id-token:write, yet pulled oven-sh/setup-bun, softprops/action-gh-release and the actions/* steps by mutable major tag and installed Bun "latest". A retagged action or a hijacked Bun release could have published a malicious npm package or release binaries. Pin every `uses:` to the full commit SHA that the current tag resolves to (v6.1.0, v2.2.0, v6.5.0, v7.0.2, v3.0.4) and pin bun-version to the current release 1.4.4. Same action versions as before, so behaviour is unchanged. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/cli-release.yml | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/.github/workflows/cli-release.yml b/.github/workflows/cli-release.yml index 2340466..c67c4b4 100644 --- a/.github/workflows/cli-release.yml +++ b/.github/workflows/cli-release.yml @@ -25,14 +25,16 @@ jobs: contents: write id-token: write # npm provenance steps: - - uses: actions/checkout@v6 + # Third-party actions are pinned to full commit SHAs (not mutable tags) + # because this job holds NPM_TOKEN, contents:write and id-token:write. + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Setup Bun - uses: oven-sh/setup-bun@v2 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: - bun-version: latest + bun-version: "1.4.4" - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: "20" cache: "npm" @@ -88,7 +90,7 @@ jobs: - name: Upload artifacts (workflow_dispatch only) if: github.event_name == 'workflow_dispatch' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: cryptohopper-cli-binaries path: | @@ -101,7 +103,7 @@ jobs: - name: Create GitHub Release if: startsWith(github.ref, 'refs/tags/cli-v') - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@8a0cd651e5b2365bd640854a3fa5dfc70e4875f3 # v3.0.4 with: name: ${{ github.ref_name }} prerelease: ${{ contains(github.ref_name, '-alpha') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-rc') }}