From 4a7efbe6e4d81b22570d09ce8b6cfb2d78eb7d53 Mon Sep 17 00:00:00 2001 From: Connal Millett Date: Wed, 12 Aug 2026 17:26:17 +0200 Subject: [PATCH] Pin action versions, add Dependabot cooldown and npm release age MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Addresses 15 Bastion SAST findings in this repo's CI and package config. Mutable action tags (13 findings, CWE-1357/353, OWASP A08). All 14 third-party `uses:` refs now name an exact version instead of a floating major or a branch: actions/checkout@v4 -> v4.4.0 actions/github-script@v6 -> v6.4.1 pnpm/action-setup@v4 -> v4.3.0 peter-evans/repository-dispatch@v2 -> v2.1.2 peter-evans/slash-command-dispatch@v3 -> v3.0.2 peter-evans/create-or-update-comment@v2 -> v2.1.1 cycjimmy/semantic-release-action@v4 -> v4.2.2 jwalton/gh-find-current-pr@master -> v1.3.5 Two were tracking branches rather than versions. semantic-release-action has no v4 tag, so `@v4` resolved to a branch head, which happens to equal tag v4.2.2 — identical code, no longer a moving ref. gh-find-current-pr@master is 2 commits ahead of its latest release, so v1.3.5 is a small change; its action.yml at that tag still provides the `state` input and `number` output this workflow uses. Dependabot cooldown (1 finding, CWE-829). `cooldown: default-days: 7` plus a github-actions ecosystem entry so the pins above get bumped rather than silently going stale. npm minimum release age (1 finding, CWE-829). `.npmrc` gains `min-release-age=7` as the rule asks, plus pnpm's `minimum-release-age=7`. Both are inert at the pinned pnpm 9.15.9 (the setting landed in pnpm 10.16 / npm 11.10) and take effect once the toolchain moves. Version tags stay mutable, so the tag findings do not satisfy the Semgrep github-actions-mutable-action-tag rule, which wants a 40-char SHA. That is a deliberate tradeoff. Co-Authored-By: Claude Opus 5 (1M context) --- .github/dependabot.yml | 16 ++++++++++++++++ .github/workflows/command.yml | 2 +- .github/workflows/release.yml | 6 +++--- .github/workflows/schema-change-notification.yml | 8 ++++---- .github/workflows/test.yml | 4 ++-- .github/workflows/update-devdoc.yml | 2 +- .github/workflows/update-dist.yml | 6 +++--- .npmrc | 8 +++++++- 8 files changed, 37 insertions(+), 15 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 96d640ac..be4617fe 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,8 +9,24 @@ updates: directory: "/" schedule: interval: "weekly" + # Hold back brand-new releases: the hours after publication are the window + # in which a compromised package version is most likely to still be live. + cooldown: + default-days: 7 # Bundle all npm updates into a single grouped PR per run. groups: npm-dependencies: patterns: - "*" + + # Keeps the exact action versions pinned in .github/workflows from going stale. + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + cooldown: + default-days: 7 + groups: + actions: + patterns: + - "*" diff --git a/.github/workflows/command.yml b/.github/workflows/command.yml index 2eaa7ae9..546da5c1 100644 --- a/.github/workflows/command.yml +++ b/.github/workflows/command.yml @@ -7,7 +7,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Slash Command Dispatch - uses: peter-evans/slash-command-dispatch@v3 + uses: peter-evans/slash-command-dispatch@v3.0.2 with: token: ${{ secrets.WOOSMAP_GH_ACCESS_TOKEN }} reaction-token: ${{ secrets.WOOSMAP_GH_ACCESS_TOKEN }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 52247c91..00e65947 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,10 +14,10 @@ jobs: WOOSMAP_PUBLIC_API_KEY: "${{ secrets.WOOSMAP_PUBLIC_API_KEY }}" WOOSMAP_PRIVATE_API_KEY: "${{ secrets.WOOSMAP_PRIVATE_API_KEY }}" steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v4.4.0 with: token: ${{ secrets.WOOSMAP_GH_ACCESS_TOKEN }} - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@v4.3.0 with: version: 9.15.9 - name: Install dependencies @@ -25,7 +25,7 @@ jobs: - run: pnpm run build - run: pnpm test - name: Semantic Release - uses: cycjimmy/semantic-release-action@v4 + uses: cycjimmy/semantic-release-action@v4.2.2 with: extra_plugins: | "@semantic-release/commit-analyzer" diff --git a/.github/workflows/schema-change-notification.yml b/.github/workflows/schema-change-notification.yml index 834d1505..af5928d3 100644 --- a/.github/workflows/schema-change-notification.yml +++ b/.github/workflows/schema-change-notification.yml @@ -13,7 +13,7 @@ jobs: actions: read steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v4.4.0 with: fetch-depth: 0 @@ -33,7 +33,7 @@ jobs: echo "EOF" >> $GITHUB_OUTPUT - name: Find PR - uses: jwalton/gh-find-current-pr@master + uses: jwalton/gh-find-current-pr@v1.3.5 id: findPr with: state: all @@ -44,7 +44,7 @@ jobs: - name: Comment on PR or linked Issue if schemas changed if: steps.schema_changes.outputs.changed_files && steps.findPr.outputs.number != '' - uses: actions/github-script@v6 + uses: actions/github-script@v6.4.1 with: github-token: ${{ secrets.HELPER_TOKEN }} script: | @@ -89,7 +89,7 @@ jobs: - name: Create issue in Woosmap/woosmap if schemas changed if: steps.schema_changes.outputs.changed_files && steps.findPr.outputs.number != '' - uses: actions/github-script@v6 + uses: actions/github-script@v6.4.1 with: github-token: ${{ secrets.HELPER_TOKEN }} script: | diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index dcc67816..54be65d7 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -5,8 +5,8 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 + - uses: actions/checkout@v4.4.0 + - uses: pnpm/action-setup@v4.3.0 with: version: 9.15.9 - name: Install dependencies diff --git a/.github/workflows/update-devdoc.yml b/.github/workflows/update-devdoc.yml index d49cd4c1..8b08cf5a 100644 --- a/.github/workflows/update-devdoc.yml +++ b/.github/workflows/update-devdoc.yml @@ -8,7 +8,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Dispatch Release Event - uses: peter-evans/repository-dispatch@v2 + uses: peter-evans/repository-dispatch@v2.1.2 with: token: ${{ secrets.WOOSMAP_GH_ACCESS_TOKEN }} repository: woosmap/developers.woosmap.com diff --git a/.github/workflows/update-dist.yml b/.github/workflows/update-dist.yml index d1ee71fc..0bd409f3 100644 --- a/.github/workflows/update-dist.yml +++ b/.github/workflows/update-dist.yml @@ -6,12 +6,12 @@ jobs: update-dist: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v4.4.0 with: token: ${{ secrets.WOOSMAP_GH_ACCESS_TOKEN }} repository: ${{ github.event.client_payload.pull_request.head.repo.full_name }} ref: ${{ github.event.client_payload.pull_request.head.ref }} - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@v4.3.0 with: version: 9.15.9 - name: Install dependencies @@ -25,7 +25,7 @@ jobs: git commit -m "chore: update dist folder [skip ci]" || true git push origin - name: Add reaction - uses: peter-evans/create-or-update-comment@v2 + uses: peter-evans/create-or-update-comment@v2.1.1 with: token: ${{ secrets.WOOSMAP_GH_ACCESS_TOKEN }} repository: ${{ github.event.client_payload.github.payload.repository.full_name }} diff --git a/.npmrc b/.npmrc index cc818e55..82531035 100644 --- a/.npmrc +++ b/.npmrc @@ -1 +1,7 @@ -hoist=false \ No newline at end of file +hoist=false + +# Delay adopting newly published versions; a compromised release is usually +# caught within days. min-release-age is npm >= 11.10, minimum-release-age is +# pnpm >= 10.16 — both inert on the pinned pnpm 9.15.9, effective after a bump. +min-release-age=7 +minimum-release-age=7