Security: pin GitHub Actions to SHA hashes - #14
Conversation
Replaces mutable tag/branch references with immutable SHA hashes to prevent supply chain attacks (ref: TeamPCP/Trivy March 2026). Actions left as tags: 0
Up to standards ✅
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
The PR attempts to harden the repository's security posture by pinning GitHub Actions to immutable SHA-1 hashes. Codacy analysis confirms the changes are up to standards with no new quality or complexity issues. However, there are significant gaps in the implementation regarding the acceptance criteria: the specific SHA pins for 'actions/github-script' and the 'atlassian/gajira' suite are currently missing or do not match the required security baseline. These gaps should be addressed before merging to satisfy the security requirements of the project.
About this PR
- The following actions are not correctly pinned to the required SHA hashes: 'actions/github-script' (6e5ee1d), 'atlassian/gajira-login' (90a5995), 'atlassian/gajira-create' (c0a9c69), and 'atlassian/gajira-comment' (8ec356b). Please ensure these specific versions are used across the workflow files to meet the security hardening requirements.
Test suggestions
- Verify that 'actions/github-script' is consistently pinned to SHA 6e5ee1d across all workflow files.
- Verify that 'atlassian/gajira-login' is pinned to SHA 90a5995 across all workflow files.
- Verify that 'atlassian/gajira-create' is pinned to SHA c0a9c69 in issue creation workflows.
- Verify that 'atlassian/gajira-comment' is pinned to SHA 8ec356b in the comment workflow.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify that 'actions/github-script' is consistently pinned to SHA 6e5ee1d across all workflow files.
2. Verify that 'atlassian/gajira-login' is pinned to SHA 90a5995 across all workflow files.
3. Verify that 'atlassian/gajira-create' is pinned to SHA c0a9c69 in issue creation workflows.
4. Verify that 'atlassian/gajira-comment' is pinned to SHA 8ec356b in the comment workflow.
🗒️ Improve review quality by adding custom instructions
2 participants
Pins all GitHub Actions from mutable tags/branches to immutable SHA hashes.
This prevents supply chain attacks like the TeamPCP/Trivy incident (March 2026), where attackers force-pushed tags to point at malicious commits.
Auto-generated by the Codacy security audit script.