GitHub Actions Update #333
Conversation
There was a problem hiding this comment.
Pull Request Overview
This pull request enhances GitHub Actions workflows with improved security practices and supply chain analysis capabilities. The main focus is on pinning action versions to specific commit SHAs and adding credential protection across all workflows.
- Updated all GitHub Actions references to use commit SHAs instead of version tags for better supply chain security
- Added
persist-credentials: falseto all checkout steps to prevent credential leakage - Introduced OSSF Scorecard workflow for automated supply chain security analysis
Reviewed Changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/test.yml |
Updated checkout and setup-node actions to pinned SHA versions |
.github/workflows/super-linter.yml |
Pinned actions to SHAs, added persist-credentials, disabled Biome validators |
.github/workflows/ossf-scorecard.yml |
New workflow for OSSF Scorecard supply-chain security analysis |
.github/workflows/npm-publish.yml |
Pinned actions to SHAs and added persist-credentials for both build and publish jobs |
.github/workflows/dependency-review.yml |
Updated actions to SHA pins and added persist-credentials |
.github/workflows/codeql-analysis.yml |
Upgraded CodeQL actions to v4 with SHA pinning and added persist-credentials |
.github/workflows/build.yml |
Pinned actions to SHAs and added persist-credentials |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }} | ||
| restore-keys: | | ||
| ${{ runner.os }}-node- | ||
| - uses: actions/checkout@v4 | ||
| - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 |
There was a problem hiding this comment.
The actions/cache step is referencing the cache before the repository is checked out. The actions/checkout step should be executed before the cache step, as the cache relies on the repository being available to hash package-lock.json. Please move the checkout step (line 26) to before line 23.
- Use Pinned SHA1 for improved security - Update super-linter.yml - Add OSSF Scorecard Update GitHub Actions workflow formatting and linter config Standardized YAML formatting in ossf-scorecard workflow and adjusted the order and inclusion of linter validation variables in super-linter.yml, including the addition of VALIDATE_GITHUB_ACTIONS_ZIZMOR. Co-Authored-By: Copilot <[email protected]>
coliff
force-pushed
the
dev/cliff/github-actions-update
branch
from
47b76a0 to
a389000
Compare
This pull request makes several improvements to the project's GitHub Actions workflows, focusing on enhanced security, up-to-date dependencies, and improved supply chain analysis. The main changes include updating action versions to specific commit SHAs for better security, adding a new workflow for OSSF Scorecard analysis, and making minor configuration improvements across workflows.
Security and Dependency Updates:
Updated all occurrences of
actions/checkout,actions/setup-node, and other major GitHub Actions to reference specific commit SHAs instead of floating version tags, improving supply chain security and build reproducibility. (.github/workflows/build.yml,.github/workflows/codeql-analysis.yml,.github/workflows/dependency-review.yml,.github/workflows/npm-publish.yml,.github/workflows/super-linter.yml,.github/workflows/test.yml) [1] [2] [3] [4] [5] [6] [7]Set
persist-credentials: falsefor allactions/checkoutsteps to reduce the risk of leaking repository credentials in workflow runs. [1] [2] [3] [4] [5] [6] [7]Supply Chain Security:
.github/workflows/ossf-scorecard.ymlworkflow to automatically run OSSF Scorecard supply chain security analysis on the repository, with results uploaded as SARIF files and published to GitHub code scanning.Linter and Quality Tooling:
super-linterto a specific commit SHA, and disabled Biome and other unneeded validators for more focused linting.Workflow File Improvements:
.github/workflows/npmpublish.ymlto.github/workflows/npm-publish.ymlfor consistency and clarity. [1] [2]