chore(ci): pin actions to commit SHAs and add dependabot cooldown - #168
Merged
Conversation
Plumb's package audit fails two security checks for this package, which together hold the composite score at 82.16: security.actions-sha-pinned 0 of 12 refs pinned (weight 8) security.dependency-update-cooldown no cooldown config (weight 4) Tag refs are mutable: a compromised maintainer can re-point v7 at arbitrary code, as tj-actions/changed-files did in March 2025. Every third-party action is now pinned to a full 40-character commit SHA with the resolved version in a trailing comment, which is also what Dependabot reads to keep the pins current. The first-party reusable workflow ref (./.github/workflows/tests.yml) stays as-is; it is covered by branch protection. The dependabot cooldown adds a 7-day minimum age before an update is proposed, so an obviously malicious release has time to be caught before it lands. Matches filamentphp/filament and bezhanSalleh/filament-shield. Also adds a CI job that fails on any unpinned third-party ref, so this cannot silently regress, and pins tests.yml to a read-only token.
This was referenced Aug 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the two failing Plumb security checks. Together they are the only thing keeping the package below 100.
security.actions-sha-pinnedsecurity.dependency-update-cooldownSecurity is scored 25 / 37 today, which is the 67.57 reported by Plumb. With both passing it is 37 / 37, taking the composite from 82.16 to 100. Maintenance and Ecosystem are already 100.
Pins
Every SHA was resolved through the GitHub API and cross-checked against the tag object it dereferences to.
actions/checkoutandshivammathur/setup-phpmatch byte-for-byte whatbezhanSalleh/filament-shieldalready ships.actions/checkout3d3c42e5aac5ba805825da76410c181273ba90b1actions/setup-node820762786026740c76f36085b0efc47a31fe5020aglipanci/laravel-pint-action36de00d5f5a8a4e12d443e01671daa12a18f4c79dependabot/fetch-metadata25dd0e34f4fe68f24cc83900b1fe3fe149efef98peter-evans/create-pull-request5f6978faf089d4d20b00c7766989d076bb2fc7f1shivammathur/setup-phpf3e473d116dcccaddc5834248c87452386958240stefanzweifel/changelog-updater-actiona938690fad7edf25368f37e43a1ed1b34303eb36stefanzweifel/git-auto-commit-action4a55954c782fc1ea30b9056cd3e7a2b40ca8887dThe trailing version comments are load-bearing. Dependabot reads them to know the current version, so
auto-merge.ymlkeeps classifying updates as semver-minor/patch correctly after pinning.uses: ./.github/workflows/tests.ymlis left alone. Plumb exempts first-party refs, which are covered by branch protection.Cooldown
default-days: 7on both update entries.github-actionssupportsdefault-daysonly, not thesemver-*-daysvariants. The threshold is at most 5 days (laravel/frameworkandlaravel/pintpass at 5); 7 matchesfilamentphp/filamentandbezhanSalleh/filament-shield.No
composerecosystem was added. "Dependabot or Renovate configured" already passes, and a library with no committed lockfile would just get constraint-churn PRs.Regression guard
New
actions-pinnedjob intests.ymlfails on any third-partyuses:lacking a 40-hex SHA. Becauserelease.ymlcallstests.ymlviaworkflow_call, releases are gated on it too.tests.ymlalso getspermissions: contents: read. It was the only workflow with nopermissions:block, so it was inheriting the repo default token scope. This is more restrictive than the caller inrelease.yml, which is allowed for reusable workflows.Verification
dependabot.ymlparse as YAML.@[0-9a-f]{40}; 1 first-party ref exempt.actions-pinnedandtestjobs on this PR exercise the new pins live.Note on when the score moves
Plumb scores the latest release tag, not the branch head. Confirmed on packages where the two differ:
spatie/laravel-permissionis scored at tag8.3.0(60e8ed5b) whilemainis atafd24018;livewire/livewireat tagv4.4.1(0c925c55) while4.xis at10b445a1.So merging this will not move the badge. It needs a
v4.1.1tag, after which Plumb rescans on its 24h cadence.