skills/mongodb__agent-skills
1
0
Fork 0
mirror of https://github.com/mongodb/agent-skills.git synced 2026-09-18 21:15:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

Pin GitHub Actions to commit SHAs (Semgrep github-actions-mutable-action-tag)

Browse Source 
14 findings on PR #55, all the same rule: a mutable major-version tag
(@v6, @v4, @v2) can be silently repointed by the action owner (or an
attacker who compromises their account) without this repo's history
changing at all -- the cited precedent is the trivy-action and
kics-github-action compromises. Pinned every actions/checkout,
create-github-app-token, setup-uv, setup-node, upload-artifact, and
download-artifact reference to its resolved commit SHA, with a
# vX.Y.Z comment for readability. Verified each SHA against the
GitHub API before using it (resolving through the annotated-tag
indirection where a tag object's own SHA isn't the commit SHA, e.g.
astral-sh/setup-uv). No behavior change -- same versions, just pinned.
This commit is contained in:
Cory Bullinger
2026-07-30 10:15:50 -04:00
parent 427cfe80cf
commit 31b6386930
4 changed files with 17 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/qa-eval-check.yml
+1 -1
View File
@@ -26,7 +26,7 @@ jobs:
check:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
fetch-depth: 0
.github/workflows/qa-mutation-battery.yml
+9 -9
View File
@@ -70,7 +70,7 @@ jobs:
outputs:
skills: ${{ steps.list.outputs.skills }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
fetch-depth: 0 # need history to diff against the pre-push SHA
@@ -146,13 +146,13 @@ jobs:
GROVE_BASE_URL: ${{ secrets.GROVE_BASE_URL }}
steps:
- name: Checkout agent-skills (this repo, public)
uses: actions/checkout@v6
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
path: agent-skills
- name: Generate a token for the agent-skills-evals GitHub App
id: app-token
uses: actions/create-github-app-token@v2
uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
with:
app-id: ${{ secrets.AGENT_SKILLS_EVALS_APP_ID }}
private-key: ${{ secrets.AGENT_SKILLS_EVALS_APP_PRIVATE_KEY }}
@@ -160,13 +160,13 @@ jobs:
repositories: agent-skills-evals
- name: Checkout agent-skills-evals (private, sibling checkout)
uses: actions/checkout@v6
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
repository: 10gen/agent-skills-evals
token: ${{ steps.app-token.outputs.token }}
path: agent-skills-evals
- uses: astral-sh/setup-uv@v4
- uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4
with:
python-version: "3.12"
@@ -199,7 +199,7 @@ jobs:
# first wins, the rest fail on non-fast-forward, and with fail-fast:false a census
# would quietly lose most of its results.
- name: Upload the sensitivity report
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: mutation-baseline-${{ matrix.skill }}
path: ${{ runner.temp }}/${{ matrix.skill }}-mutation.json
@@ -212,14 +212,14 @@ jobs:
steps:
- name: Generate a token for the agent-skills-evals GitHub App
id: app-token
uses: actions/create-github-app-token@v2
uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
with:
app-id: ${{ secrets.AGENT_SKILLS_EVALS_APP_ID }}
private-key: ${{ secrets.AGENT_SKILLS_EVALS_APP_PRIVATE_KEY }}
owner: 10gen
repositories: agent-skills-evals
- uses: actions/checkout@v6
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
repository: 10gen/agent-skills-evals
token: ${{ steps.app-token.outputs.token }}
@@ -227,7 +227,7 @@ jobs:
# Whatever succeeded gets published: a skill whose battery failed simply has no
# artifact, so a partial census still lands its usable half.
- name: Download every skill's report
uses: actions/download-artifact@v4
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
with:
pattern: mutation-baseline-*
path: incoming
.github/workflows/qa-pr-screen.yml
+5 -5
View File
@@ -96,7 +96,7 @@ jobs:
outputs:
skills: ${{ steps.list.outputs.skills }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
fetch-depth: 0
@@ -158,14 +158,14 @@ jobs:
GROVE_BASE_URL: ${{ secrets.GROVE_BASE_URL }}
steps:
- name: Checkout agent-skills at the PR head
uses: actions/checkout@v6
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
path: agent-skills
ref: ${{ github.event_name == 'workflow_dispatch' && github.ref || github.event.pull_request.head.sha }}
- name: Generate a token for the agent-skills-evals GitHub App
id: app-token
uses: actions/create-github-app-token@v2
uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
with:
app-id: ${{ secrets.AGENT_SKILLS_EVALS_APP_ID }}
private-key: ${{ secrets.AGENT_SKILLS_EVALS_APP_PRIVATE_KEY }}
@@ -173,13 +173,13 @@ jobs:
repositories: agent-skills-evals
- name: Checkout agent-skills-evals (private, sibling checkout)
uses: actions/checkout@v6
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
repository: 10gen/agent-skills-evals
token: ${{ steps.app-token.outputs.token }}
path: agent-skills-evals
- uses: astral-sh/setup-uv@v4
- uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4
with:
python-version: "3.12"
.github/workflows/validate-eval-cases.yml
+2 -2
View File
@@ -26,11 +26,11 @@ jobs:
validate-eval-cases:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
# Co-movement needs the base commit's SKILL.md to compare against.
fetch-depth: 0
- uses: actions/setup-node@v4
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: "20"
- name: Install validator deps