trufflesecurity/trufflehog
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Pin GitHub Actions to SHA digests (#4985)

Browse Source 
Convert all GitHub Actions uses: refs from mutable tags to immutable
SHA pins with version comments. This prevents tag-hijack supply chain
attacks while preserving version tracking for Renovate.

Part of the org-wide Dependency Strategy Unification (Step 2).

Co-authored-by: Cursor <[email protected]>
This commit is contained in:
Bryan Beverly
2026-05-27 14:03:37 -07:00
committed by GitHub
co-authored by Cursor
parent 52ebebb9b0
commit 36f6f69707
10 changed files with 40 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/codeql-analysis.yml
+4 -4
View File
@@ -38,14 +38,14 @@ jobs:
steps:
- name: Checkout repository
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- name: Install Go
uses: actions/setup-go@v6
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
with:
go-version: "1.25"
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
uses: github/codeql-action/init@v4
uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4
with:
languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -56,4 +56,4 @@ jobs:
run: |
go build .
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v4
uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4
.github/workflows/detector-corpora-test.yml
+1 -1
View File
@@ -108,7 +108,7 @@ jobs:
- name: Configure AWS credentials
if: steps.detect.outputs.any_changed == 'true'
uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6
uses: aws-actions/configure-aws-credentials@acca2b1b2070338fb9fd1ca27ecee81d687e58e5 # v6
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
.github/workflows/detector-tests.yml
+4 -4
View File
@@ -14,13 +14,13 @@ jobs:
contents: "read"
id-token: "write"
steps:
- uses: actions/checkout@v6
- uses: actions/setup-go@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
- name: Install gotestsum
uses: jaxxstorm/action-install-gh-release@v3.0.0 # immutable release; no rolling @v3 tag
uses: jaxxstorm/action-install-gh-release@25e24d2d23ae098373794ef1d6faecb48ee52da8 # v3.0.0
with:
repo: gotestyourself/gotestsum
- uses: rwx-research/setup-captain@v1
- uses: rwx-research/setup-captain@f761ee3671e4c027299f8a5842a53fba8ddd8e37 # v1
- name: Test Go
run: |
export CGO_ENABLED=1
.github/workflows/lint.yml
+8 -8
View File
@@ -15,12 +15,12 @@ jobs:
name: golangci-lint
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/setup-go@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
with:
go-version: "1.25"
- name: golangci-lint
uses: golangci/golangci-lint-action@v9
uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9
with:
# NOTE: Version and args must match scripts/lint.sh
version: v2.11.4
@@ -29,8 +29,8 @@ jobs:
name: man-page-staleness
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/setup-go@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
with:
go-version: "1.25"
- name: Regenerate man page
@@ -48,7 +48,7 @@ jobs:
image: returntocorp/semgrep
if: (github.actor != 'dependabot[bot]')
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- run: semgrep --config=hack/semgrep-rules/detectors.yaml pkg/detectors/
checksecretparts:
# Reports detector packages that construct detectors.Result without
@@ -56,8 +56,8 @@ jobs:
name: checksecretparts
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/setup-go@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
with:
go-version: "1.25"
- name: Run checksecretparts
.github/workflows/performance.yml
+3 -3
View File
@@ -11,13 +11,13 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
fetch-depth: 0
ref: ${{ github.head_ref }}
- name: Install Go
uses: actions/setup-go@v6
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
with:
go-version: "1.25"
@@ -54,7 +54,7 @@ jobs:
echo PREVIOUS_TAG=$(cat previous_tag.txt) >> $GITHUB_ENV
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
fetch-depth: 0
ref: ${{ env.PREVIOUS_TAG }}
.github/workflows/release-bot.yml
+2 -2
View File
@@ -14,12 +14,12 @@ jobs:
steps:
- name: Login to GCP
id: auth
uses: "google-github-actions/auth@v3"
uses: "google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093" # v3
with:
credentials_json: ${{ secrets.GCP_SA_TRUFFLE_RELEASE_BOT }}
- name: Login to GAR
uses: docker/login-action@v4
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
with:
registry: us-central1-docker.pkg.dev
username: _json_key
.github/workflows/release.yml
+6 -6
View File
@@ -18,24 +18,24 @@ jobs:
steps:
# Setup steps - no external side effects.
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
fetch-depth: 0
- name: Set up QEMU
uses: docker/setup-qemu-action@v4
uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4
- name: Docker Login to DockerHub
uses: docker/login-action@v4
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Docker Login to GitHub Container Registry
uses: docker/login-action@v4
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Set up Go
uses: actions/setup-go@v6
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
with:
go-version: "1.25"
- name: Cosign install
@@ -64,7 +64,7 @@ jobs:
# version. The release is NOT marked latest (make_latest: false), so
# /releases/latest still points to the previous good release.
- name: Run GoReleaser
uses: goreleaser/goreleaser-action@v7
uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7
with:
distribution: goreleaser-pro
version: latest
.github/workflows/secrets.yml
+1 -1
View File
@@ -15,7 +15,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
fetch-depth: 0
ref: ${{ github.head_ref }}
.github/workflows/smoke.yml
+4 -4
View File
@@ -8,9 +8,9 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- name: Install Go
uses: actions/setup-go@v6
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
with:
go-version: "1.25"
- name: Smoke
@@ -23,9 +23,9 @@ jobs:
timeout-minutes: 5
steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- name: Install Go
uses: actions/setup-go@v6
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
with:
go-version: "1.25"
- name: Run trufflehog
.github/workflows/test.yml
+7 -7
View File
@@ -18,13 +18,13 @@ jobs:
id-token: "write"
steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- name: Install Go
uses: actions/setup-go@v6
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
with:
go-version: "1.25"
- id: "auth"
uses: "google-github-actions/auth@v3"
uses: "google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093" # v3
with:
workload_identity_provider: "projects/811013774421/locations/global/workloadIdentityPools/github-pool/providers/github-provider"
service_account: "[email protected]"
@@ -38,7 +38,7 @@ jobs:
if: ${{ success() || failure() }} # always run this step, even if there were previous errors
- name: Upload test results to BuildPulse for flaky test detection
if: ${{ !cancelled() }} # Run this step even when the tests fail. Skip if the workflow is cancelled.
uses: buildpulse/buildpulse-action@main
uses: buildpulse/buildpulse-action@d4d8e00c645a2e3db0419a43664bbcf868080234 # main
with:
account: 79229934
repository: 77726177
@@ -48,7 +48,7 @@ jobs:
secret: ${{ secrets.BUILDPULSE_SECRET_ACCESS_KEY }}
tags: integration
- name: Annotate test results
uses: mikepenz/action-junit-report@v6
uses: mikepenz/action-junit-report@3a81627bfac62268172037048872e8ebd4207e6d # v6
if: success() || failure() # always run even if the previous step fails
with:
report_paths: "tmp/test-results/*.xml"
@@ -60,9 +60,9 @@ jobs:
contents: "read"
steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- name: Install Go
uses: actions/setup-go@v6
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
with:
go-version: "1.25"
- name: Test