Hash pin github workflow dependencies

[joycebrum]

Description

Hi again, I would like to suggest another security practice recommended by the OpenSSF Scorecard, and the GitHub itself, which is to hash pin the CI dependencies to prevent dependency-confusion, typosquatting and tag renaming attacks.

This means:

• Hash pinning GitHub Workflow actions.
• Using --require-hashes on pip installs.

Along with hash-pinning dependencies, I also recommend adopting dependabot or renovatebot to help keep the dependencies up to date. Both tools can update hashes and associated semantic version comments.

Let me know if you are open to evaluate those changes and I'll submit the PR ASAP.

Any questions or concerns just let me know. Thanks!

Additional Context

Regarding Github Actions: A tag renaming attack is a type of attack whereby an attacker:

• Hijack an action.
• Upload a malicious version.
• Replace existing tags with malicious versions.

Regarding package managers (such as pip): A dependency-confusion attack occurs when an attacker:

• Find the name of a package that the victims wants to install
• Create an identically named package and publish it under the public or default registry.
• Assign the package with a higher version number to trick the package manager tool to download it from the public repo.

A typosquatting attack is a type of attack whereby an attacker:

• Create a malicious package
• Publish it with a similar name of a known package (example: numpi instead of numpy)

For more informations about the dependency-update tools:

• Dependabot
• Renovatebot

[diogoteles08]

Hey! This issue/PR has been idle for quite some time. Do you plan on considering this suggestion?

For your specific case, hash-pinning your dependencies on build.yml should be valuable because it's responsible for uploading your wheels to the releases, right? So any malicious or broken changes on the unpinned dependencies on that workflows could endanger possible users that consumes those wheels.

In case you don't show interest on these changes, we'll probably wait up to 2 more months and close the issue.

Thanks!

[github-actions[bot]]

Message to comment on stale issues. If none provided, will not mark issues stale