From 0e803833fb1f1458a204863136118190b4b128d6 Mon Sep 17 00:00:00 2001 From: Copilot <198982749+Copilot@users.noreply.github.com> Date: Sun, 12 Apr 2026 19:31:32 +1000 Subject: [PATCH] chore: pin GitHub Actions and Docker base images to full-length hashes (OSSF scorecard) (#2658) * Initial plan * chore: pin GitHub Actions dependencies to specific commit SHAs (OSSF) Agent-Logs-Url: https://github.com/mikefarah/yq/sessions/cbd03f0a-f2dc-4da4-b01c-7dd06ad83ee9 Co-authored-by: mikefarah <1151925+mikefarah@users.noreply.github.com> * chore: pin Dockerfile base images to specific SHA digests (OSSF) Agent-Logs-Url: https://github.com/mikefarah/yq/sessions/7a8f6690-37fb-42ab-b3dc-0dd23c270fbe Co-authored-by: mikefarah <1151925+mikefarah@users.noreply.github.com> * chore: revert yq pins in test-yq.yml; add release note for github-action/Dockerfile SHA Agent-Logs-Url: https://github.com/mikefarah/yq/sessions/e1b35d79-92a3-47d5-b4ac-a2efe2fd58ce Co-authored-by: mikefarah <1151925+mikefarah@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: mikefarah <1151925+mikefarah@users.noreply.github.com> --- .github/workflows/codeql.yml | 8 ++++---- .github/workflows/docker-release.yml | 10 +++++----- .github/workflows/go.yml | 4 ++-- .github/workflows/release.yml | 6 +++--- .github/workflows/snap-release.yml | 6 +++--- .github/workflows/test-yq.yml | 2 +- Dockerfile | 4 ++-- Dockerfile.dev | 2 +- github-action/Dockerfile | 2 +- release_instructions.txt | 4 ++++ 10 files changed, 26 insertions(+), 22 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 86376b56..15f0db98 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -38,11 +38,11 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -53,7 +53,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v4 + uses: github/codeql-action/autobuild@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 # ℹī¸ Command-line programs to run using the OS shell. # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun @@ -67,4 +67,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml index de0f247a..67ebc797 100644 --- a/.github/workflows/docker-release.yml +++ b/.github/workflows/docker-release.yml @@ -14,16 +14,16 @@ jobs: IMAGE_NAME: mikefarah/yq runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up QEMU - uses: docker/setup-qemu-action@v4 + uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 with: platforms: all - name: Set up Docker Buildx id: buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 with: version: latest @@ -31,13 +31,13 @@ jobs: run: echo ${{ steps.buildx.outputs.platforms }} && docker version - name: Login to Docker Hub - uses: docker/login-action@v4 + uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} - name: Login to GitHub Container Registry - uses: docker/login-action@v4 + uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml index 1dec4376..1167577d 100644 --- a/.github/workflows/go.yml +++ b/.github/workflows/go.yml @@ -11,13 +11,13 @@ jobs: steps: - name: Set up Go - uses: actions/setup-go@v6 + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version: '^1.20' id: go - name: Check out code into the Go module directory - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Get dependencies run: | diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c629af3c..0029faeb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -9,8 +9,8 @@ jobs: publishGitRelease: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: actions/setup-go@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version: '^1.20' check-latest: true @@ -44,7 +44,7 @@ jobs: ./scripts/xcompile.sh - name: Release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2 with: files: build/* draft: true diff --git a/.github/workflows/snap-release.yml b/.github/workflows/snap-release.yml index 2661edbc..6b8d1969 100644 --- a/.github/workflows/snap-release.yml +++ b/.github/workflows/snap-release.yml @@ -12,14 +12,14 @@ jobs: environment: snap runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: snapcore/action-build@v1 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: snapcore/action-build@3bdaa03e1ba6bf59a65f84a751d943d549a54e79 # v1.3.0 id: build env: SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.STORE_LOGIN }} with: snapcraft-args: "remote-build --launchpad-accept-public-upload" - - uses: snapcore/action-publish@v1 + - uses: snapcore/action-publish@214b86e5ca036ead1668c79afb81e550e6c54d40 # v1.2.0 env: SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.STORE_LOGIN }} with: diff --git a/.github/workflows/test-yq.yml b/.github/workflows/test-yq.yml index 8128b3c9..f3108fb5 100644 --- a/.github/workflows/test-yq.yml +++ b/.github/workflows/test-yq.yml @@ -13,7 +13,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Get test id: get_value uses: mikefarah/yq@master diff --git a/Dockerfile b/Dockerfile index a598c449..003948a4 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26.2 AS builder +FROM golang:1.26.2@sha256:2a2b4b5791cea8ae09caecba7bad0bd9631def96e5fe362e4a5e67009fe4ae61 AS builder WORKDIR /go/src/mikefarah/yq @@ -10,7 +10,7 @@ RUN ./scripts/acceptance.sh # Choose alpine as a base image to make this useful for CI, as many # CI tools expect an interactive shell inside the container -FROM alpine:3 AS production +FROM alpine:3@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659 AS production LABEL maintainer="Mike Farah " COPY --from=builder /go/src/mikefarah/yq/yq /usr/bin/yq diff --git a/Dockerfile.dev b/Dockerfile.dev index 51209dc6..d12597e3 100644 --- a/Dockerfile.dev +++ b/Dockerfile.dev @@ -1,4 +1,4 @@ -FROM golang:1.26.2 +FROM golang:1.26.2@sha256:2a2b4b5791cea8ae09caecba7bad0bd9631def96e5fe362e4a5e67009fe4ae61 RUN apt-get update && \ apt-get install -y npm && \ diff --git a/github-action/Dockerfile b/github-action/Dockerfile index dfc90866..cc737fda 100644 --- a/github-action/Dockerfile +++ b/github-action/Dockerfile @@ -1,4 +1,4 @@ -FROM mikefarah/yq:4 +FROM mikefarah/yq:4@sha256:603ebff15eb308a05f1c5b8b7613179cad859aed3ec9fdd04f2ef5d32345950e COPY entrypoint.sh /entrypoint.sh diff --git a/release_instructions.txt b/release_instructions.txt index 6b2fdf9d..23ef7d4c 100644 --- a/release_instructions.txt +++ b/release_instructions.txt @@ -8,6 +8,10 @@ - git push --tags - use github actions to publish docker and make github release - check github updated yq action in marketplace +- update github-action/Dockerfile to pin the newly published docker image digest: + skopeo inspect docker://docker.io/mikefarah/yq:4 | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['Digest'])" + then update the FROM line in github-action/Dockerfile with the new digest: + FROM mikefarah/yq:4@sha256: - snapcraft