Use GitHub actions at your own risk
julienrenaux.fr
Use GitHub actions at your own risk
1–10 of 65 posts
Re: Use GitHub actions at your own risk
#2The same could be said for any use of docker images. Seems a little unfair to single out Github.
Re: Use GitHub actions at your own risk
#3The same could be said for any use of docker images. Seems a little unfair to single out Github.
That's definitely true, but given the sensitivity of having access to private source and secrets I think its fair to call out a warning.
Re: Use GitHub actions at your own risk
#4Title should be adjusted to mention branches & tags specifically.
Re: Use GitHub actions at your own risk
#5The same could be said for any use of docker images. Seems a little unfair to single out Github.
That's definitely true, but given the sensitivity of having access to private source and secrets I think its fair to call out a warning.
couldn't a malicious docker image also be tooled to dump all of that stuff to an external destination?
Re: Use GitHub actions at your own risk
#6> Each hash is supposed to be unique and you cannot rewrite history with the exact same SHA-1.
I thought SHA-1 wasn't considered secure?
Re: Use GitHub actions at your own risk
#7This also applies to most library, docker (as mentioned) and basically anything you use that's 3rd party. I suppose it varies on your level of paranoia, though honestly if you rely on a github action in your production flow you should fork the project. Never mind doing something malicious, they could just as easily delete the entire repo and now your critical feature you needed to deliver are blocked because the library you were relying one has disappeared.
Anything you use in a critical path you should control. If you're managing your own fork, nobody will inject bad code except yourself.
Just my 2 cents. Also, the things that github 3rd party actions are doing is usually not that complicated. I mean how many different ways can you publish a docker image or deploy an artifact to S3. Once it works, it either works or doesn't. It's not a programming library where optimizations are created or we fixed a security vulnerability (though I suppose that can come up ).
Sorry minor rant. food for thought.
Re: Use GitHub actions at your own risk
#8> Each hash is supposed to be unique and you cannot rewrite history with the exact same SHA-1. I thought SHA-1 wasn't considered secure?
It isn’t, according to NIST.
Re: Use GitHub actions at your own risk
#9This is correct, using a commit hash is safer.
However, you'll sometimes want to update the commit hash after the action's maintainer releases new code. If you don't then you run the risk of running an old action that has vulnerable components or bugs.
The easiest workflow for that should be Dependabot's updater for GitHub actions: https://dependabot.com/github-actions/ Has anyone tried that approach for GitHub actions?
You still need to review the action's code before you use it, and every time you update to a new commit hash. But this approach protects you from automatically running new malicious code pushed to master/re-tagged.
Re: Use GitHub actions at your own risk
#10> Each hash is supposed to be unique and you cannot rewrite history with the exact same SHA-1. I thought SHA-1 wasn't considered secure?
See https://marc.info/?l=git&m=148787047422954 for some of linus thoughts about this.