Fix workflow security issues: action pinning and unauthorized action sources

[dimahc]

Problem

Plumber Radar scan of orange-cloudavenue/cloudavenue-sdk-go revealed 21 high-severity issues across two controls:

1. Action Pinning (actionPinningResult)

GitHub Actions should be pinned to a full-length commit SHA, not a version tag (e.g., @v4) or branch (@main). Tag-based references are mutable — a malicious actor can retag a compromised version.

Examples found in the repo's workflows:

# Unpinned — uses branch/tag reference
- uses: actions/checkout@master
- uses: actions/checkout@v4
- uses: gacts/github-slug@v1
- uses: crazy-max/ghaction-github-status@v4
- uses: actions/setup-go@v5
- uses: coverallsapp/github-action@v2
- uses: actions/github-script@v7
- uses: peter-evans/create-pull-request@v7
- uses: amannn/action-semantic-pull-request@v5
- uses: actions/labeler@v5
- uses: license-eye/github-action@v1
- uses: ncipollo/release-action@v1
- uses: goreleaser/goreleaser-action@v6
- uses: softprops/action-gh-release@v2
- uses: betaHuhn/repo-file-sync-action@v2 (the sync workflow uses SHA but many others don't)

These should all be replaced with their pinned SHA equivalents, e.g.:

- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2

2. Authorized Action Sources (authorizedActionSourcesResult)

Using actions from unapproved or third-party sources without review. The org should maintain an allowlist of trusted action publishers (e.g., actions/*, orange-cloudavenue/*, verified GitHub creators, etc.) and ensure all actions in workflows come from approved sources.

Required Fixes

• Audit all 20+ workflow files in .github/workflows/ for unpinned action references
• Pin every action to its full commit SHA, with a comment noting the semantic version
• Define an allowlist of authorized action sources for the org
• Add a lint/pre-commit check that enforces action pinning going forward (e.g., actionlint with pinning rules, or a custom check)
• Update the sync config so fix propagates to all consumer repos
• Re-scan with Plumber to verify compliance

References

• GitHub Security Lab: Pinning actions to a full length commit SHA
• Plumber scan result: https://getplumber.io/radar?q=orange-cloudavenue%2Fcloudavenue-sdk-go
• OpenSSF Scorecard: https://securityscorecards.dev/