What steps did you take:
Reviewed the GitHub Actions workflow configurations in the .github/workflows/ directory to audit supply-chain security hygiene.
Specifically, I checked for mutable action references using:
grep -rnE "uses:.*@(v[0-9]|main|master|latest)" .github/workflows/
What happened:
Currently, there are 38 call sites across 13 workflow files referencing third-party and reusable GitHub Actions using mutable tags (e.g., @v3.7.0, @v4, @main, @latest).
What did you expect:
To protect the repository from supply chain attacks, GitHub Actions should be pinned to immutable commit SHAs rather than mutable tags. If a third-party action's tag is force-moved or the upstream repository is compromised, the CI pipeline could execute malicious code.
This is particularly critical for workflows like release-process.yml, which operate with elevated permissions (id-token: write, packages: write, and contents: write).
Anything else you would like to add:
The recommended best practice is to resolve each mutable ref to its exact commit SHA, while appending the human-readable version as a comment.
For example:
Before: uses: actions/checkout@v4
After: uses: actions/checkout@34e1148 # v4
Because dependabot.yml is already configured for the github-actions ecosystem in this repository, Dependabot will natively handle updating these SHAs and their version comments automatically going forward. There is zero additional maintenance burden for the team.
Environment:
- kapp Controller version (execute
kubectl get deployment -n kapp-controller kapp-controller -o yaml and the annotation is kbld.k14s.io/images):
- Kubernetes version (use
kubectl version)
Vote on this request
This is an invitation to the community to vote on issues, to help us prioritize our backlog. Use the "smiley face" up to the right of this comment to vote.
👍 "I would like to see this addressed as soon as possible"
👎 "There are other more important things to focus on right now"
We are also happy to receive and review Pull Requests if you want to help working on this issue.
What steps did you take:
Reviewed the GitHub Actions workflow configurations in the .github/workflows/ directory to audit supply-chain security hygiene.
Specifically, I checked for mutable action references using:
grep -rnE "uses:.*@(v[0-9]|main|master|latest)" .github/workflows/
What happened:
Currently, there are 38 call sites across 13 workflow files referencing third-party and reusable GitHub Actions using mutable tags (e.g., @v3.7.0, @v4, @main, @latest).
What did you expect:
To protect the repository from supply chain attacks, GitHub Actions should be pinned to immutable commit SHAs rather than mutable tags. If a third-party action's tag is force-moved or the upstream repository is compromised, the CI pipeline could execute malicious code.
This is particularly critical for workflows like release-process.yml, which operate with elevated permissions (id-token: write, packages: write, and contents: write).
Anything else you would like to add:
The recommended best practice is to resolve each mutable ref to its exact commit SHA, while appending the human-readable version as a comment.
For example:
Before: uses: actions/checkout@v4
After: uses: actions/checkout@34e1148 # v4
Because dependabot.yml is already configured for the github-actions ecosystem in this repository, Dependabot will natively handle updating these SHAs and their version comments automatically going forward. There is zero additional maintenance burden for the team.
Environment:
kubectl get deployment -n kapp-controller kapp-controller -o yamland the annotation iskbld.k14s.io/images):kubectl version)Vote on this request
This is an invitation to the community to vote on issues, to help us prioritize our backlog. Use the "smiley face" up to the right of this comment to vote.
👍 "I would like to see this addressed as soon as possible"
👎 "There are other more important things to focus on right now"
We are also happy to receive and review Pull Requests if you want to help working on this issue.