checkout

The actions/checkout repo still doesn't even use immutable releases so I'll believe it when I see it https://github.com/actions/checkout/issues/2316

When it's down to brass tacks, the most common GitHub action, actions/checkout, is not taking contributions due to "focus [...] on strategic areas" [0] despite having years-old issues - here's one[1] that soon celebrates its sixth birthday, despite having an available PR! [0] https://github.com/actions/checkout#note [1] https://github.com/actions/checkout/issues/270#issue-6289677...

To add on, GitHub has made it explicitly clear that they are both not working on features to focus on their Azure adoption and many core projects are in stasis even from community contributions. https://github.com/actions/checkout#note

Well, it is a git commit hash of the action repo that contains the transpiled/bundled javascript. Like: https://github.com/actions/checkout/tree/11bd71901bbe5b1630c... So I'm pretty sure that for the same commit hash, I'll be executing the same content.

The offending commit seems to be: https://github.com/aquasecurity/trivy/commit/1885610c6a34811... which updates the action to `actions/checkout@70379aad1a8b40919ce8b382d3cd7d0315cde1d0 # v6.0.2`. https://github.com/actions/checkout/commit/70379aad1a8b40919... is not actually in `actions/checkout` but a fork, and it pulls malicious code from the typo-squatted "scan.aquasecurtiy.org" (note the _tiy_). Any system with Trivy 0.69.4 on it (and being run) can be assumed to be compromised.

what with actions/checkout@v4, hows that documented? https://github.com/actions/checkout/issues/567#issuecomment-... GH has a `permissions:` entry and this mechanism already for internal repo action sharing. And thousands of our dollars per month.

Here is an example in the wild: https://github.com/actions/checkout/actions/workflows/publis...

> At a glance, this looks like an immutable reference to an already-released “version 2” of this action, but actually this is a mutable Git tag. If somebody changes the v2 tag in the tj-actions/changed-files repo to point to a different commit, this action will run different code the next time it runs. The worst part of this is that this is BY DESIGN. I maintain a small handful of actions. You are expected to, as an action maintainer DELETE and RETAG your major versions when you release a new minor or patch version. That is to say for instance your v2 tag should point to the same commit as your latest 2.x.x tag. Not everyone does this mind you, but this is the default and the expected way of operating. I was frankly kind of taken aback when I learned this. I know for a fact documentation of this used to exist, but I am failing to find it

It seems pretty awful that the de-facto way to use GitHub Actions is using git tags which are not immutable. For example to checkout code [1]: - uses: actions/checkout@v4 Github does advise people to harden their actions by referring to git commit hashes [2] but Github currently only supports SHA-1 as hashing algorithm. Creating collisions with this hashing algo will be more and more affordable and I'm afraid that we will see attacks using the hash collisions during my lifetime. I wish that they will add support for SHA-256 soon and wrote product feedback regarding it here: https://github.com/orgs/community/discussions/154056 If this resonates with you please go and give it a thumbs up :) [1]: https://github.com/actions/checkout?tab=readme-ov-file#usage [2]: https://docs.github.com/en/actions/security-for-github-actio...

I think a big part of the problem is the way one typically "installs" a GH action: by copy-pasting something from README of the action. Let's have a look at a random official GH provided action: https://github.com/actions/checkout It lists the following snippet: `uses: actions/checkout@v4` Almost everyone will just copy paste this snippet and call it a day. Most people don't think twice that v4 is a movable target that can be compromised. In case of npm/yarn deps, one would often do the same, and copy paste `yarn install foobar`, but then when installing, npm/yarn would create a lockfile and pin the version. Whereas there's no "installer" CLI for GH actions that would pin the version for you, you just copy-paste and git push. To make things better, ideally, the owners of actions would update the workflows which release a new version of th

I was checking out the actions/checkout repository, which is something most GitHub actions are bound to use, and navigated to the issues: https://github.com/actions/checkout/issues On the first page alone I found cryptocurrency scams, zero-effort issues, and outright spam, from days to months old. It is an official GitHub repository for one of their most popular actions in a major feature, with hundreds of watchers and thousands of forks and stars. Yet it looks abandoned.

> The real problem is keeping sensetive information in .git directory. Like WTH would you put your password, in plaintext, in some general ini file? (or into a source file for that matter)? Sometimes it's not "you": https://github.com/actions/checkout/issues/485

Instead, they run over a merge commit from the base branch: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#p… This means CI is always running over commits that don't exist anywhere in the repo, and change whenever master changes. If you re-run GHA after master changes, CI is testing over different code. You can disable this on the checkout action: https://github.com/actions/checkout#checkout-pull-request-head-commit-instead-of-m… Posting because every senior developer that I know is surprised to learn this, so curious if this is the behaviour people expect.