Security: pin GitHub Actions to SHA hashes#115
Conversation
Replaces mutable tag/branch references with immutable SHA hashes to prevent supply chain attacks (ref: TeamPCP/Trivy March 2026). Actions left as tags: 0
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
While this PR aims to improve repository security by pinning GitHub Actions to immutable SHA hashes, the current implementation fails to address the core requirements for several key dependencies. Additionally, critical logic bugs were introduced in the workflow files: one step uses out-of-scope environment variables which will cause it to be skipped incorrectly, and another step lacks basic null-checking on regex results, which will likely cause a workflow crash. Race conditions in asynchronous API calls were also identified. Although Codacy metrics are passing, these functional and alignment issues must be resolved before merging.
About this PR
- The primary objective of this PR—pinning actions to SHA hashes—appears incomplete. Specifically, actions/github-script, atlassian/gajira-login, atlassian/gajira-comment, and atlassian/gajira-create still require pinning to their respective SHAs as per the project requirements.
Test suggestions
- Verify actions/github-script@v2.0.0 is pinned to SHA 6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45
- Verify atlassian/gajira-login@v2.0.0 is pinned to SHA 90a599561baaf8c05b080645ed73db7391c246ed
- Verify atlassian/gajira-comment@v2.0.2 is pinned to SHA 8ec356b5df49f1325653db7ee2da2b59a1d78203
- Verify atlassian/gajira-create@v2.0.1 is pinned to SHA c0a9c69ac9d6aa063fed57201e55336ada860183
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify actions/github-script@v2.0.0 is pinned to SHA 6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45
2. Verify atlassian/gajira-login@v2.0.0 is pinned to SHA 90a599561baaf8c05b080645ed73db7391c246ed
3. Verify atlassian/gajira-comment@v2.0.2 is pinned to SHA 8ec356b5df49f1325653db7ee2da2b59a1d78203
4. Verify atlassian/gajira-create@v2.0.1 is pinned to SHA c0a9c69ac9d6aa063fed57201e55336ada860183
🗒️ Improve review quality by adding custom instructions
3 participants
Pins all GitHub Actions from mutable tags/branches to immutable SHA hashes.
This prevents supply chain attacks like the TeamPCP/Trivy incident (March 2026), where attackers force-pushed tags to point at malicious commits.
Auto-generated by the Codacy security audit script.