Pin actions to a specific commit instead of branches / tags

[BryceStevenWilley]

Pinning a composite GitHub Action to a specific commit SHA is considered best practice, but TBH it's an absolute pain, especially with the number of other actions we depend on.

I'm re-evaluating that idea due to the recent TeamPCP campaign, which initially used a compromised GitHub Action to steal credentials from other projects, and has been slowly using those credentials. (some more information about that: https://www.sans.org/blog/when-security-scanner-became-weapon-inside-teampcp-supply-chain-campaign).

We should pin all "untrusted" GitHubActions that we are using to specific commits (right now, make that the latest commit of the tag or branch they are currently pinned to). That is, we'll change all actions that are not:

• from the actions user, which is owned by GitHub
  • we use these everywhere, so upgrading the pinned SHA would be multiple magnitudes more work than pinning to tags.
  • if GitHub itself is compromised, we have much bigger issues.
• the official pypa/gh-action-pypi-publish action
  • this helps us switch to trusted publishing, which reduces the number credentials that could be compromised in an attack
  • again, if pypa is compromised, the python ecosystem will have much bigger problems elsewhere in our stack
• any of our own actions

The full list that I've found, split between myself and @rajeswari1301:

Myself:

• legal-tech-class: Pin gh-pages action to specific commit legal-tech-class#38
• student_reflictions: https://github.com/SuffolkLITLab/student_reflections/pull/1
• MAVirtualCourt: Delete .github/workflows/auto_close_empty_issues.yml docassemble-MAVirtualCourt#773
• MAHousingTRO: Delete .github/workflows/auto_close_empty_issues.yml docassemble-MAHousingTRO#41
• ALActions/black: Pin action for black and PR creation to commit SHAs #78

@rajeswari1301

• EfileProxyServer (and this action too): Pin flyctl action to specific commit SHA EfileProxyServer#359
• docassemble-AssemblyLine-documentation: Pin peaceiris action to specific commit SHA AssemblyLine-docs#599
• LITEFile: pin flyctl actions to specific commit SHA LITEFile#93

[BryceStevenWilley]

I believe this is all done now; closing!