Merge pull request #178 from ErenAri/fix/scorecard-pin-deps

fix(security): pin all GitHub Actions + Docker images to SHA hashes

Author: ErenAri

.github/workflows/aegis-next.yml

@@ -1,5 +1,7 @@
 name: aegis-next prototype
 
+permissions: read-all
+
 on:
   push:
     branches: [main, develop, 'feat/aegis-next-*']
@@ -21,7 +23,7 @@ jobs:
     name: aegis-next (build + test)
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Install dependencies
         run: |
@@ -129,7 +131,7 @@ jobs:
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: aegis-next-test-results
           path: build/aegis_next_test.xml
@@ -139,9 +141,9 @@ jobs:
     name: Operator aegis-next translator
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version-file: operator/go.mod
 
@@ -161,10 +163,10 @@ jobs:
     name: Helm chart lint
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Set up Helm
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@bf6a7d304bc2fdb57e0331155b7ebf2c504acf0a # v4
 
       - name: Lint default values
         run: helm lint helm/aegisbpf/

.github/workflows/arm64-production.yml

@@ -38,7 +38,7 @@ jobs:
     name: Cross-compile ARM64
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Install ARM64 cross-compilation toolchain
         run: |
@@ -106,7 +106,7 @@ jobs:
           fi
 
       - name: Upload ARM64 binary
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: aegisbpf-arm64
           path: build-arm64/aegisbpf
@@ -118,7 +118,7 @@ jobs:
     runs-on: ubuntu-24.04
     needs: cross-compile
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Install QEMU and ARM64 libraries
         run: |
@@ -199,7 +199,7 @@ jobs:
     if: always()
     steps:
       - name: Download ARM64 binary
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: aegisbpf-arm64
 
@@ -230,7 +230,7 @@ jobs:
           cat report.md
 
       - name: Upload report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: arm64-validation-report
           path: report.md

.github/workflows/benchmark.yml

@@ -15,7 +15,7 @@ jobs:
     name: benchmark
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Install dependencies
         run: |
@@ -74,7 +74,7 @@ jobs:
 
       - name: Store benchmark result (PR advisory)
         if: steps.benchmark-history.outputs.exists == 'true' && github.event_name == 'pull_request'
-        uses: benchmark-action/github-action-benchmark@v1
+        uses: benchmark-action/github-action-benchmark@f4c8b6b6887e53d3f07a8f026d9d75157713386b # v1
         with:
           tool: googlecpp
           output-file-path: benchmark.json
@@ -87,7 +87,7 @@ jobs:
 
       - name: Store benchmark result (main advisory)
         if: steps.benchmark-history.outputs.exists == 'true' && github.event_name != 'pull_request'
-        uses: benchmark-action/github-action-benchmark@v1
+        uses: benchmark-action/github-action-benchmark@f4c8b6b6887e53d3f07a8f026d9d75157713386b # v1
         with:
           tool: googlecpp
           output-file-path: benchmark.json
@@ -106,7 +106,7 @@ jobs:
 
       - name: Upload benchmark artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: benchmark-result
           path: |

.github/workflows/bootstrap-repo-controls.yml

@@ -27,7 +27,7 @@ jobs:
   bootstrap:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Select token
         run: |

.github/workflows/bpf-compiler-matrix.yml

@@ -29,7 +29,7 @@ jobs:
             runner: ubuntu-24.04
     runs-on: ${{ matrix.runner }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Install LLVM ${{ matrix.clang_version }}
         run: |

.github/workflows/bpf-coverage.yml

@@ -15,7 +15,7 @@ jobs:
     name: bpf-coverage
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Install dependencies
         run: |
@@ -101,7 +101,7 @@ jobs:
 
       - name: Upload BPF coverage summary
         if: steps.bpf_check.outputs.bpf_ready == 'true'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: bpf-coverage-summary
           path: build/bpf_coverage_summary.json

.github/workflows/branch-protection-audit.yml

@@ -13,7 +13,7 @@ jobs:
   audit:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Audit branch protection required checks
         id: audit_checks
@@ -45,14 +45,14 @@ jobs:
 
       - name: Upload audit log
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: branch-protection-audit
           path: branch-protection-audit.log
 
       - name: Open or update drift issue
         if: steps.audit_checks.outputs.failed == 'true'
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             const fs = require('fs');

.github/workflows/canary.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: [self-hosted, bpf-lsm]
     timeout-minutes: 90
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Install dependencies (if apt-get is available)
         run: |
@@ -48,7 +48,7 @@ jobs:
         run: sudo AEGIS_BIN=./build/aegisbpf PHASE=enforce ENFORCE_SIGNAL=term DURATION_SECONDS=300 MAX_RINGBUF_DROPS=100 MAX_RSS_GROWTH_KB=65536 MAX_EVENT_DROP_RATIO_PCT=0.1 MIN_TOTAL_DECISIONS=100 scripts/canary_gate.sh
 
       - name: Upload canary artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: canary-artifacts
           path: artifacts/canary/

.github/workflows/check-vendored.yml

@@ -22,7 +22,7 @@ jobs:
   check-vendored:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Run vendored dependency audit
         id: audit
@@ -31,14 +31,14 @@ jobs:
 
       - name: Upload audit report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: vendored-dependency-audit
           path: vendored-check.log
 
       - name: Open issue on failure
         if: steps.audit.outcome == 'failure'
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             const title = 'Vendored dependency review required';