From 7ee96b2d9267d1a165712304e64e3150bc118d6c Mon Sep 17 00:00:00 2001 From: Connal Millett Date: Wed, 12 Aug 2026 17:17:23 +0200 Subject: [PATCH] Pin action versions and add Dependabot cooldown MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Addresses 16 Bastion SAST findings in this repo's CI config. Mutable action tags (15 findings, CWE-1357/353, OWASP A08). All 16 third-party `uses:` refs now name an exact patch version instead of a floating major, each resolved from what that major points at today so behaviour is unchanged: actions/checkout@v4 -> v4.4.0 actions/cache@v3 -> v3.5.0 actions/setup-node@v4 -> v4.4.0 actions/upload-artifact@v4 -> v4.6.2 aws-actions/configure-aws-credentials@v4 -> v4.3.1 peter-evans/repository-dispatch@v2 -> v2.1.2 cycjimmy/semantic-release-action@v6 -> v6.0.0 `cycjimmy/semantic-release-action@v6` was the notable one: there is no v6 tag on that repo, so the ref resolved to a *branch* named v6 — a moving head, not a version. Tag v6.0.0 points at the same commit. Missing Dependabot cooldown (1 finding, CWE-829). Adds `cooldown: default-days: 7` to hold back freshly published releases, plus a github-actions ecosystem entry so the pins above get bumped rather than silently going stale. Version tags stay mutable, so the tag findings do not satisfy the Semgrep github-actions-mutable-action-tag rule, which wants a 40-char SHA. That is a deliberate tradeoff; the cooldown covers the same threat. Co-Authored-By: Claude Opus 5 (1M context) --- .github/dependabot.yml | 16 ++++++++++++++++ .github/workflows/e2e.yml | 8 ++++---- .github/workflows/pr-to-s3.yml | 6 +++--- .github/workflows/push-to-s3.yml | 6 +++--- .github/workflows/release.yml | 6 +++--- .github/workflows/test.yml | 4 ++-- .github/workflows/update-devdoc.yml | 2 +- 7 files changed, 32 insertions(+), 16 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 5908ded2..60c6e00e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,7 +4,23 @@ updates: directory: "/" # Location of package manifests schedule: interval: "weekly" + # Hold back brand-new releases: the hours after publication are the window + # in which a compromised package version is most likely to still be live. + cooldown: + default-days: 7 groups: dependencies: patterns: - "*" + + # Keeps the exact action versions pinned in .github/workflows from going stale. + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + cooldown: + default-days: 7 + groups: + actions: + patterns: + - "*" diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index a0e46aaa..8415a2be 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -24,16 +24,16 @@ jobs: shard: [1, 2, 3, 4, 5, 6, 7, 8] fail-fast: false steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v4.4.0 with: lfs: true - - uses: actions/cache@v3 + - uses: actions/cache@v3.5.0 with: path: ~/.npm key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }} restore-keys: | ${{ runner.os }}-node - - uses: actions/cache@v3 + - uses: actions/cache@v3.5.0 with: path: ~/.cache/ms-playwright key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}-e2e @@ -50,7 +50,7 @@ jobs: env: CI: true - name: Push test report to artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v4.6.2 if: failure() with: name: Test Results ${{ github.sha }} diff --git a/.github/workflows/pr-to-s3.yml b/.github/workflows/pr-to-s3.yml index 4837944f..1d29f1f8 100644 --- a/.github/workflows/pr-to-s3.yml +++ b/.github/workflows/pr-to-s3.yml @@ -9,8 +9,8 @@ jobs: if: "!contains(github.event.head_commit.message, 'skip ci')" runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/cache@v3 + - uses: actions/checkout@v4.4.0 + - uses: actions/cache@v3.5.0 with: path: ~/.npm key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }} @@ -24,7 +24,7 @@ jobs: rm -rf dist/samples/**/package-lock.json rm -rf dist/samples/**/app/.gitignore - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@v4.3.1 with: aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} diff --git a/.github/workflows/push-to-s3.yml b/.github/workflows/push-to-s3.yml index ade49c7d..44217850 100644 --- a/.github/workflows/push-to-s3.yml +++ b/.github/workflows/push-to-s3.yml @@ -8,8 +8,8 @@ jobs: if: "!contains(github.event.head_commit.message, 'skip ci')" runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/cache@v3 + - uses: actions/checkout@v4.4.0 + - uses: actions/cache@v3.5.0 with: path: ~/.npm key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }} @@ -23,7 +23,7 @@ jobs: rm -rf dist/samples/**/package-lock.json rm -rf dist/samples/**/app/.gitignore - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@v4.3.1 with: aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1931bab5..617259c5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -12,12 +12,12 @@ jobs: issues: write pull-requests: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v4.4.0 with: token: ${{ secrets.WOOSMAP_GH_ACCESS_TOKEN }} persist-credentials: false - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v4.4.0 with: node-version: '22' cache: 'npm' @@ -42,7 +42,7 @@ jobs: GH_TOKEN: ${{ secrets.WOOSMAP_GH_ACCESS_TOKEN }} - name: Semantic Release - uses: cycjimmy/semantic-release-action@v6 + uses: cycjimmy/semantic-release-action@v6.0.0 with: extra_plugins: | @semantic-release/commit-analyzer diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 7f2f2b19..f90eda7c 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -18,8 +18,8 @@ jobs: github.event.review.state == 'approved') runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/cache@v3 + - uses: actions/checkout@v4.4.0 + - uses: actions/cache@v3.5.0 with: path: ~/.npm key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }} diff --git a/.github/workflows/update-devdoc.yml b/.github/workflows/update-devdoc.yml index 3a3cb785..3aeacf9b 100644 --- a/.github/workflows/update-devdoc.yml +++ b/.github/workflows/update-devdoc.yml @@ -8,7 +8,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Dispatch Release Event - uses: peter-evans/repository-dispatch@v2 + uses: peter-evans/repository-dispatch@v2.1.2 with: token: ${{ secrets.WOOSMAP_GH_ACCESS_TOKEN }} repository: woosmap/developers.woosmap.com