mirror of
https://github.com/RayLabsHQ/gitea-mirror.git
synced 2026-07-07 02:11:00 +02:00
ARUNAVO RAY
a02865a1aa
Tags are mutable. A compromised maintainer (or a maintainer's compromised machine) can force-move v-tags to point at malicious commits, and any workflow using `@vN` picks up the malicious code on its next run — see the recent `actions-cool/issues-helper` / `maintain-one-comment` incident exfiltrating credentials from `Runner.Worker` memory. This commit pins every third-party action in the two workflows that handle secrets (GHCR push, Docker Hub login, Scout token) to immutable 40-char SHAs, with a trailing comment naming the release version for readability. SHAs are the latest released tag at time of pin. The two DeterminateSystems actions were on `@main` — a *branch* ref that moves on every push, materially worse than a tag — and are now pinned to the latest release SHAs (v22 / v13). First-party `actions/*` and `github/codeql-action` are left on tags for now; they're a separate, lower-risk follow-up.
58 lines
1.4 KiB
YAML
58 lines
1.4 KiB
YAML
name: Nix Flake Check
|
|
|
|
on:
|
|
push:
|
|
branches: [main, nix]
|
|
tags:
|
|
- 'v*'
|
|
paths:
|
|
- 'flake.nix'
|
|
- 'flake.lock'
|
|
- 'bun.nix'
|
|
- 'bun.lock'
|
|
- 'package.json'
|
|
- '.github/workflows/nix-build.yml'
|
|
pull_request:
|
|
branches: [main]
|
|
paths:
|
|
- 'flake.nix'
|
|
- 'flake.lock'
|
|
- 'bun.nix'
|
|
- 'bun.lock'
|
|
- 'package.json'
|
|
- '.github/workflows/nix-build.yml'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
check:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
env:
|
|
NIX_CONFIG: |
|
|
accept-flake-config = true
|
|
access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install Nix
|
|
uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
|
|
|
|
- name: Setup Nix Cache
|
|
uses: DeterminateSystems/magic-nix-cache-action@565684385bcd71bad329742eefe8d12f2e765b39 # v13
|
|
|
|
- name: Regenerate bun.nix from bun.lock
|
|
run: nix run --accept-flake-config github:nix-community/bun2nix -- -o bun.nix
|
|
|
|
- name: Check flake
|
|
run: nix flake check --accept-flake-config
|
|
|
|
- name: Show flake info
|
|
run: nix flake show --accept-flake-config
|
|
|
|
- name: Build package
|
|
if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
|
|
run: nix build --print-build-logs --accept-flake-config
|