ci: pin third-party GitHub Actions to commit SHAs - #265
Merged
Conversation
Replace floating version tags (v3, v6) with full 40-character commit SHAs for aws-actions/configure-aws-credentials, docker/build-push-action, docker/login-action, docker/setup-buildx-action, and dorny/paths-filter across claude-code.yaml, pull_request.yaml, and release-to-ghcr.yaml. Each pin retains a trailing version comment for readability. Floating tags can be repointed by the upstream maintainer (or an attacker who compromises their account) to inject malicious code into CI, since tags are mutable refs. Pinning to immutable commit SHAs closes that supply-chain attack surface, per the org-wide third-party action pinning policy (INF-2571). Ticket: INF-2714 Session-Id: 82bb60fb-74af-4eb0-980d-e679d6c0dedf Task-Id: 0b7e8841-a9ac-4e3e-af8c-61b160a2d06c
bitgo-ai-agent-dev
Bot
force-pushed
the
louis/inf-2714-pin-third-party-actions
branch
from
August 14, 2026 20:15
a3e216f to
6ed7b1b
Compare
ralph-bitgo
Bot
force-pushed
the
louis/inf-2714-pin-third-party-actions
branch
from
August 14, 2026 20:15
6ed7b1b to
d3adafd
Compare
louib
approved these changes
Aug 14, 2026
danielpeng1
approved these changes
Aug 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Pins the 7 third-party GitHub Action usages in this repo from floating
version tags to full 40-character commit SHAs (with a trailing
# vX.Y.Zcomment for readability):
.github/workflows/claude-code.yamlaws-actions/configure-aws-credentialsv6e6de054...(v6.2.3).github/workflows/pull_request.yamldocker/build-push-actionv610e90e3...(v6.19.2).github/workflows/release-to-ghcr.yamldocker/build-push-actionv610e90e3...(v6.19.2).github/workflows/release-to-ghcr.yamldocker/login-actionv3c94ce9f...(v3.7.0).github/workflows/pull_request.yamldocker/setup-buildx-actionv38d2750c...(v3.12.0).github/workflows/release-to-ghcr.yamldocker/setup-buildx-actionv38d2750c...(v3.12.0).github/workflows/pull_request.yamldorny/paths-filterv30e4a8c6...(v3.0.4)Why
Floating tags (
v3,v6) are mutable refs — the upstream maintainer (or anattacker who compromises their account) can repoint a tag to different code
at any time, giving that code access to this repo's CI secrets and OIDC role.
Pinning to an immutable commit SHA closes that supply-chain attack surface.
This is part of the org-wide third-party GitHub Action pinning effort
tracked in INF-2571/INF-2710. These 7 actions were grandfathered with an
exception in
BitGo/build-system's zizmor CI policy; this PR is theper-repo migration for
BitGo/advanced-walletsso that exception caneventually be removed once every usage org-wide is pinned.
BitGo-owned/first-party actions (
actions/checkout,actions/setup-node,etc.) are explicitly out of scope here — tracked separately in INF-2572.
Test plan
comment via the GitHub API (peeling annotated tags where needed)
with:inputs used by each step remain valid at the pinnedpatch version (no interface drift within the same major version)
pull_request.yaml's pinned actionsdirectly)
Ticket: INF-2714