search

rossjrw / pr-preview-action

GitHub Action that deploys a pull request preview to GitHub Pages, similar to Vercel and Netlify, and cleans up after itself.
https://github.com/marketplace/actions/deploy-pr-preview
MIT License
255 stars 39 forks source link

chore: use fixed hashes for the dependency actions #79

Closed erikwrede closed 5 months ago

erikwrede commented 5 months ago

Thanks for this great action!

Since the action is dependent on some other actions (JamesIves/github-pages-deploy-action@v4, marocchino/sticky-pull-request-comment@v2), it may be succeptible to some supply chain attacks, see here: https://www.rwx.com/blog/github-actions-is-vulnerable-to-supply-chain-attacks

Some malicious actor could take over the mentioned dependencies and change the v2 release to any arbitrary release without anyone noticing. That's why it's a good practice to pin your actions and their dependencies (some orgs even enforce this).

When pinning this action to a specific commit in the repo settings, you still need to pin the dependencies to v2 / v4 and cannot set them to a specific commit since the action definition requires versions.

This PR mitigates the supply chain attack risk by pinning all dependencies to a specific version. I understand that this slightly increases maintenance efforts, as minor- and patch- updates to the upstream actions need to be done by hand. However, I advocate that in the spirit of security, this change is useful. Please LMK your thougts.

rossjrw commented 5 months ago

Did a little research into whether or not this is considered a best practice. The answer I'm getting is, overwhelmingly, yes - it was https://github.com/renovatebot/renovate/issues/7537 that ended up convincing me.

Thanks for the contribution @erikwrede, will merge once I've verified the SHAs!

rossjrw commented 5 months ago

Released in v1.4.7