[grace-hopper-day] Pin Github Actions by commit-hash - nodejs/diagnostics #1107
Description
Pin Actions to a full length commit SHA
Repository: https://github.com/nodejs/diagnostics
Why is this needed?
- GitHub Action tags and Docker tags are mutable, which poses a security risk
- If the tag changes you will not have a chance to review the change before it gets used
- GitHub's Security Hardening for GitHub Actions guide recommends pinning actions to full length commit for third party actions.
Before and After the fix
Before the fix, your workflow may look like this (use of v1 and latest tags)
After the fix, Secure-Repo pins each Action and docker image to an immutable checksum.
Pull request example: electron/electron#36343
In this pull request, the workflow file has the GitHub Actions tags pinned automatically to their full-length commit SHA.
From: https://github.com/step-security/secure-repo#3-pin-actions-to-a-full-length-commit-sha