Ensure SHA Pinned Actions

https://github.com/zgosalvez/github-actions-ensure-sha-pinned-actions

Admin

A GitHub Action that ensures all referenced GitHub Actions are pinned to full length commit SHAs for...

Tokens:1,061

Snippets:15

Trust Score:6.5

License:MIT

Update:5 months ago

Show doc for...

Tokens:

Raw

### Allowlist Configuration Example

Source: https://github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/blob/main/README.md

Configure the `allowlist` input to specify owners or repositories that should be ignored and not cause an error. Each entry should be on a new line.

```yaml
allowlist: |
  aws-actions/          # Trust all actions published by aws-actions
  docker/login-action   # Trust docker's login-action only
```

--------------------------------

### Common Workflow Example

Source: https://github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/blob/main/README.md

Integrate this action as an initial job in your CI workflow to ensure all referenced GitHub Actions are pinned to full length commit SHAs. The `actions/checkout` action is used here for code checkout.

```yaml
on: push

name: Continuous Integration

jobs:
  harden_security:
    name: Harden Security
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
      - name: Ensure SHA pinned actions
        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@v2 # Replace this
        with:
          allowlist: |
            aws-actions/
            docker/login-action
```

Tokens:

Raw