From 5aeafef62ad57927088862232d4abe2c9f832d23 Mon Sep 17 00:00:00 2001 From: elhoim Date: Sun, 30 Aug 2026 23:50:29 +0000 Subject: [PATCH] Pin GitHub Actions to commit SHAs in PyPI publish workflow The build/publish workflow referenced actions/checkout@v4, actions/setup-python@v5, actions/upload-artifact@v4, actions/download-artifact@v4 and pypa/gh-action-pypi-publish@release/v1 by mutable tag/branch names. The publish job carries id-token: write for PyPI trusted publishing, so a repointed tag or compromised release branch could run untrusted code with publish rights. Pin every action to its current full commit SHA (with the corresponding version as a trailing comment) to eliminate that supply-chain surface. --- .github/workflows/pypi-publish.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/pypi-publish.yml b/.github/workflows/pypi-publish.yml index 48a95d5..ce703a5 100644 --- a/.github/workflows/pypi-publish.yml +++ b/.github/workflows/pypi-publish.yml @@ -14,10 +14,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout source - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: '3.12' @@ -28,7 +28,7 @@ jobs: run: python -m build - name: Upload distribution artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: dist path: dist/ @@ -45,7 +45,7 @@ jobs: url: https://pypi.org/p/misp-modules-cli steps: - name: Download distribution artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: dist path: dist/ @@ -107,6 +107,6 @@ jobs: - name: Publish package to PyPI if: steps.filter-existing.outputs.has-files == 'true' - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 with: skip-existing: true