How to harden GitHub Actions • Hacker News Board

Re: How to harden GitHub Actions

#71

Post by guappa » Fri, May 09, 2025, 5:53 AM UTC

RadiozRadioz wrote: post #56

photonthug wrote: post #54

Earlier quoted context omitted.

In the newest iteration of a time-honored tradition, grub (and/or whatever distro's treatment of it) has been finding all kinds of ways to break upgrades for 30 years. If you're on the happy path you can probably go a long time without a problem. But when you're the unlucky one and need to search for a fix, and you're checking hardware/distro/date details in whatever forums or posts, and that's when you notice that t…

No that's not what I mean, I mean technologically, UEFI is flashed in your motherboard and there isn't any way for an OS to mess with that. You need to boot from a specially prepared USB with compatible firmware in order to change it. Your problem must have been above UEFI, or an error in your OS that mentioned UEFI.

There have been buggy implementations where UEFI is in fact NOT flashed to the motherboard and can get removed.

If he has one of those crappy computers it could be, but when I read about it happening it was entirely due to users MANUALLY deleting the UEFI files, did not happen upgrading.

So, the story seems still wrong to me.

Re: How to harden GitHub Actions

#72

Post by guappa » Fri, May 09, 2025, 5:59 AM UTC

KronisLV wrote: post #25

wongarsu wrote: post #22

Earlier quoted context omitted.

In principle by having the repository maintainer review the code they are packaging. They can't do a full security review of every package and may well be fooled by obfuscated code or deliberately introduced bugs, but the threshold for a successful attack is much higher than on Github Actions or npm.

It kinda feels like any CI/CD should only be run on the server after one of the maintainers gives it the okay to do so, after reviewing the code. From this, one can also make the assumption that most of the CI (linting, various checks and tests) should all be runnable locally even before any code is pushed.

It feels to me that CI/CD and builds for release should be completely separated concepts.

Re: How to harden GitHub Actions

#73

Post by remram » Fri, May 09, 2025, 1:16 PM UTC

ebfe1 wrote: post #30

After tj-actions hack, I put together a little tool to go through all of github actions in repository to replace them with commit hash of the version https://github.com/santrancisco/pmw It has a few "features" which allowed me to go through a repository quickly: - It prompts user and recommend the hash, it also provides user the url to the current tag/action to double check the hash value matches and review the code…

Having control is good, but reading all the code yourself seems unrealistic. We need something like crev or cargo-vet.

Re: How to harden GitHub Actions

#74

Post by ebfe1 » Fri, May 09, 2025, 2:10 PM UTC

remram wrote: post #73

ebfe1 wrote: post #30

After tj-actions hack, I put together a little tool to go through all of github actions in repository to replace them with commit hash of the version https://github.com/santrancisco/pmw It has a few "features" which allowed me to go through a repository quickly: - It prompts user and recommend the hash, it also provides user the url to the current tag/action to double check the hash value matches and review the code…

Having control is good, but reading all the code yourself seems unrealistic. We need something like crev or cargo-vet.

Yea hence it prompts for you to check the first time but once you verify the hash for particular version of action, it would automatically apply the hash to that same version of action everywhere. Also you can reuse the same config for all other repos so it is only tedious the first time but after that it is pretty quick to apply to the rest of the org :)

The tool is indeed meant for semi-auto flow to ensure human eye looked at the action being used.