From 6e8ae1cde50f2b846a56af5718b6ed97140d73a2 Mon Sep 17 00:00:00 2001 From: J3vb <192430104+J3vb@users.noreply.github.com> Date: Thu, 30 Jul 2026 15:03:49 +0200 Subject: [PATCH] ci(release): pin third-party actions to commit SHAs (F5) Every third-party action in release.yml resolved through a mutable tag or branch inside jobs that hold TAURI_SIGNING_PRIVATE_KEY and SERVER_UPDATE_SIGNING_PRIVATE_KEY, so anyone able to repoint an upstream ref gained code execution beside OwnCord's code-signing keys. All 31 uses refs are now pinned to full commit SHAs with version comments, matching what ci.yml already does. No tests cover this change: nothing in the project exercises .github/workflows, and GitHub Actions cannot run in the local environment. The change was verified by a panel of agents on review alone. Confirmed here: the diff touches 31 uses lines and nothing else, release.yml still parses with all 6 jobs and their step counts intact, all 8 actions shared with ci.yml carry byte-identical pins, and the 3 release-only pins were checked against upstream. The release is now frozen to the pinned versions; Dependabot manages that ecosystem weekly. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/release.yml | 62 +++++++++++++++++------------------ 1 file changed, 31 insertions(+), 31 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9e6918f1..ae4d09c2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -12,19 +12,19 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 20 cache: npm cache-dependency-path: Client/tauri-client/package-lock.json - name: Install Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable - name: Rust cache - uses: swatinem/rust-cache@v2 + uses: swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8 with: workspaces: Client/tauri-client/src-tauri @@ -52,7 +52,7 @@ jobs: if [ -n "$NSIS_SIG" ] && [ -f "$NSIS_SIG" ]; then cp "$NSIS_SIG" release-staging/; fi - name: Upload Windows release assets - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: windows-release-assets path: release-staging/ @@ -63,9 +63,9 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 20 cache: npm @@ -86,10 +86,10 @@ jobs: xdg-utils - name: Install Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable - name: Rust cache - uses: swatinem/rust-cache@v2 + uses: swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8 with: workspaces: Client/tauri-client/src-tauri @@ -123,7 +123,7 @@ jobs: if [ -n "$DEB" ] && [ -f "$DEB" ]; then cp "$DEB" linux-staging/; fi - name: Upload Linux release assets - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: linux-release-assets path: linux-staging/ @@ -142,9 +142,9 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0 with: go-version: "1.26" @@ -173,14 +173,14 @@ jobs: - name: Upload Windows binary if: matrix.os == 'windows-latest' - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: ${{ matrix.artifact }} path: Server/chatserver.exe - name: Upload Linux archive if: matrix.os == 'ubuntu-latest' - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: ${{ matrix.artifact }} path: chatserver-linux-amd64.tar.gz @@ -191,9 +191,9 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 20 cache: npm @@ -214,10 +214,10 @@ jobs: xdg-utils - name: Install Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable - name: Rust cache - uses: swatinem/rust-cache@v2 + uses: swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8 with: workspaces: Client/tauri-client/src-tauri @@ -256,7 +256,7 @@ jobs: done - name: Upload Linux ARM64 release assets - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: linux-arm64-release-assets path: linux-arm64-staging/ @@ -268,7 +268,7 @@ jobs: contents: read packages: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Extract version from tag shell: bash @@ -277,10 +277,10 @@ jobs: echo "VERSION=$VERSION" >> "$GITHUB_ENV" - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0 - name: Log in to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -288,7 +288,7 @@ jobs: - name: Extract Docker metadata id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0 with: images: ghcr.io/${{ github.repository_owner }}/owncord-server tags: | @@ -297,7 +297,7 @@ jobs: type=raw,value=latest - name: Build and push - uses: docker/build-push-action@v6 + uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0 with: context: Server/ push: true @@ -314,40 +314,40 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 20 cache: npm cache-dependency-path: Client/tauri-client/package-lock.json - name: Download Windows client assets - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: windows-release-assets path: windows - name: Download Linux x86_64 client assets - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: linux-release-assets path: linux - name: Download Linux ARM64 client assets - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: linux-arm64-release-assets path: linux - name: Download Windows server binary - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: server-windows path: windows - name: Download Linux server archive - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: server-linux path: linux