From 007cb11dd5a370e6b0143eb880153bbb190fd596 Mon Sep 17 00:00:00 2001 From: 07souravkunda Date: Mon, 21 Sep 2026 15:56:47 +0530 Subject: [PATCH] ci: pin gem-push workflow actions to immutable commit SHAs The gem-publish workflow resolved actions/checkout, ruby/setup-ruby and rubygems/configure-rubygems-credentials from mutable tags (@v3 / @v1 / @v2.0.0). A hijacked or force-pushed upstream tag could redirect the resolved action code into the job that publishes the gem (CWE-829, supply-chain injection). Pin all three to full 40-char commit SHAs, with a version comment, matching the pattern the repo's Semgrep.yml already uses. - actions/checkout -> c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - ruby/setup-ruby -> a0102e0972be65f351c307e2d64b9314a57c8073 # v1.324.0 - rubygems/configure-rubygems-credentials -> 762a4b77c3300434bb57c7ce80b20e36231927aa # v2.0.0 Co-Authored-By: Claude Opus 4.8 --- .github/workflows/gem-push.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/gem-push.yml b/.github/workflows/gem-push.yml index ec9028e..a3f9274 100644 --- a/.github/workflows/gem-push.yml +++ b/.github/workflows/gem-push.yml @@ -11,13 +11,13 @@ jobs: id-token: write steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - name: Set up Ruby 2.6 - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@a0102e0972be65f351c307e2d64b9314a57c8073 # v1.324.0 with: ruby-version: 2.6.10 - - uses: rubygems/configure-rubygems-credentials@v2.0.0 + - uses: rubygems/configure-rubygems-credentials@762a4b77c3300434bb57c7ce80b20e36231927aa # v2.0.0 - name: Build and push gem run: | gem build *.gemspec