From ae6fa8948d584512ae942077833d911ac236c21c Mon Sep 17 00:00:00 2001
From: Dyc0de <dylan@boostsecurity.io>
Date: Fri, 21 Aug 2026 14:07:05 -0400
Subject: [PATCH] Add the cicd-gha-unpinned-action rule to the catalog

Registers the rule emitted by boostsec-scanner-native as
cicd-gha-unpinned-action, and rolls the baseline image pin forward to the
build that carries it (8f8a409), so the catalog entry and the image that
backs it land together.

Categorized under supply-chain-missing-artifact-integrity-verification
alongside cicd-unpinned-dependencies: an unpinned reference is a download
without integrity verification, the same failure mode as a missing lockfile.

Note the pin jumps 19 commits from 6b6cf90, not just the one adding this
rule. Eighteen of those are the #190 lockfile rework, so this also changes
cicd-unpinned-dependencies here: it gains eight ecosystems and resolves a
lock file from the repository root, which stops it reporting every member
of a cargo or uv workspace.

Tracked by https://github.com/boostsecurityio/workspace/issues/296
---
 scanners/boostsecurityio/baseline/module.yaml |  2 +-
 scanners/boostsecurityio/scanner/rules.yaml   | 16 ++++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/scanners/boostsecurityio/baseline/module.yaml b/scanners/boostsecurityio/baseline/module.yaml
index 7d53e4b3..c0532ae8 100644
--- a/scanners/boostsecurityio/baseline/module.yaml
+++ b/scanners/boostsecurityio/baseline/module.yaml
@@ -41,7 +41,7 @@ steps:
     - scan:
         command:
           docker:
-            image: ghcr.io/boostsecurityio/scanner-publishing/boost-scanner-native:6b6cf90@sha256:285e3bd9b11cf47c5e28d501eca0dd70a139f8c02ec1d9a469ba69d3d77dd8f9
+            image: ghcr.io/boostsecurityio/scanner-publishing/boost-scanner-native:8f8a409@sha256:7254ed0df115e4fb5bbf362db17bd87b6c28d7ee8a815f73645bfec217676aa6
             command: scanner scan
             workdir: /src
           name: scanner
diff --git a/scanners/boostsecurityio/scanner/rules.yaml b/scanners/boostsecurityio/scanner/rules.yaml
index afb193c4..211c58fb 100644
--- a/scanners/boostsecurityio/scanner/rules.yaml
+++ b/scanners/boostsecurityio/scanner/rules.yaml
@@ -107,6 +107,22 @@ rules:
     pretty_name: CI/CD - GitHub Action Unsecure Commands
     ref: '{BOOSTSEC_DOC_BASE_URL}/rules/cicd-gha-unsecure-commands.html'
     recommended: true
+  cicd-gha-unpinned-action:
+    categories:
+      - ALL
+      - supply-chain
+      - supply-chain-missing-artifact-integrity-verification
+      - boost-baseline
+      - boost-hardened
+    description: Checks for GitHub Action workflows and composite actions referencing
+      actions or reusable workflows that are not pinned to a full commit SHA. A
+      mutable reference such as a branch or a tag can be repointed at different code
+      after review, so the pinned artifact is not the one that was audited.
+    group: supply-chain-missing-artifact-integrity-verification
+    name: cicd-gha-unpinned-action
+    pretty_name: CI/CD - GitHub Action Unpinned Action
+    ref: '{BOOSTSEC_DOC_BASE_URL}/rules/cicd-gha-unpinned-action.html'
+    recommended: true
   cicd-unpinned-dependencies:
     categories:
       - ALL