I recently shared how Aaron convinced me to pin our GitHub Actions to a commit hash.
One of the things I left unanswered in that tip is how to know if one of your pinned GitHub Actions has a security vulnerability.
With PHP packages, I'd run composer audit, and I wanted the same thing for our workflows.
GitHub already tracks security advisories for actions, so Dependabot alerts seemed like the obvious answer, but there's a catch if you read the Limitations section in the docs. Alerts are only generated for actions that use semantic versioning, not SHA versioning.
This is annoying. By following GitHub's advice to pin actions to a SHA, we also turn off GitHub's ability to generate alerts for those actions.
There is a tool that fills this gap though.
It's called zizmor, and it's a static analyzer for GitHub Actions workflows which does a lot more than security alerts.
It does need a GitHub API token to run some of its checks, but you can give it a barebones token that only has permission to read public repos.
It uses the API to map each pinned hash back to a version and checks that version against the advisory database.
As a fun experiment, I pinned a throwaway workflow to an old commit of tj-actions/changed-files, the compromised action from the previous tip.
error[known-vulnerable-actions]: action has a known vulnerability
8 | - uses: tj-actions/changed-files@2d756ea4c53f7f6b397767d8723b3a10a9f35bf2 # v44.0.0
| GHSA-mrrh-fwg8-r2c3
One other nice thing this tool does is verify that the version comment next to each hash matches the commit, so I can trust those comments, and I'll know if they ever drift.
And on top of that, zizmor is also a general workflow linter.
One of its rules even requires SHA-pinned actions, like we've been talking about.
Like other static analysis tools, if you don't agree with one of its rules, you can disable it in a configuration file.
You can use it manually from your CLI, which is useful, but in an upcoming tip I'll also show you can automate checks from within Github Actions. I'll also show how to keep those SHA-pinned versions moving forward without a lot of ceremony.
Stay tuned!
Here to help,
Joel
P.S. A linter only catches the patterns it knows about. For everything else, a code review gives you a second set of eyes on your app and how you ship it.
