Single-source reviewed action pins and verify tag provenance - #63
Merged
Conversation
Every GitHub Actions bump previously broke two test files, because the reviewed commit was duplicated in the allowlist and again in the pull request and release workflow fixtures. The fixtures now assert only that each action is reached through a 40-character commit pin, so TestActiveWorkflowsUseReviewedCurrentActions owns the reviewed values alone and a bump is a single-file edit. Add scripts/verify-action-pins.sh, which resolves every pinned commit against the release tag its comment advertises through the GitHub API. The offline allowlist proves a human acknowledged a pin but cannot see whether that commit belongs to the stated release, which is the gap a repointed tag exploits. Run it from an additive Action Pin Provenance job rather than a required check. It depends on the GitHub API, so an upstream outage must not block merges, and Dependabot always bumps to a real tag, so this check alone would approve every bump.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Every GitHub Actions bump broke two test files instead of one. The reviewed
commit was duplicated in three places: the workflow itself, the reviewed-pin
allowlist, and the PR/release workflow fixtures. PR #61 hit this, and the
ledger records the same failure on PR #44 (F-040).
The duplication bought no extra safety. The allowlist already asserts the exact
commit for every action and that every approved action is exercised by a
workflow, so repeating the value in the fixtures only added an edit site.
What changed
Single source of truth for reviewed pins. The PR and release fixtures now
assert only that each action is reached through a 40-character commit pin.
TestActiveWorkflowsUseReviewedCurrentActionsalone holds the reviewed commitvalues, so a version bump is a single-file edit. All four of its assertions are
unchanged.
Tag provenance verification.
scripts/verify-action-pins.shresolves everypinned commit against the release tag its comment advertises through the GitHub
API, dereferencing annotated tags and mapping subdirectory actions such as
anchore/sbom-action/download-syftto their owning repository.The offline allowlist proves a human acknowledged a pin, but it cannot see
whether that commit actually belongs to the stated release. That is the gap a
repointed tag exploits, and it was previously covered only by reviewer
diligence.
The new job is deliberately not a required check. It depends on the GitHub
API, so an upstream outage must not block merges. It is also additive rather
than a replacement: Dependabot always bumps to a real tag, so this check alone
would rubber-stamp every bump. The allowlist remains the blocking control.
Verification
go test -race ./internal/ciworkflowpassesmake verify-action-pinspasses: all 8 pinned actions resolve to theiradvertised release tags
with
@v4fails the allowlist and the new fixture assertion. Swapping in areal-but-wrong commit (
v4.5.1's SHA behind a# v4.6.0comment) fails theprovenance script, which is exactly the tag-repointing case
actionlint,shellcheck,gofmt, andgolangci-lintcleanNote
Dependabot Actions PRs still will not go green unaided. That is intentional, and
it is the control that converts an automated bump into a reviewed one. They now
need one focused edit in one file.