From b739dfee0bcb6a29080ced773e94f939572ae91d Mon Sep 17 00:00:00 2001 From: Thibaud-Vdb Date: Tue, 4 Aug 2026 17:01:56 +0200 Subject: [PATCH] CI: pins actions to commit SHAs A version tag like @v1 or a branch like @master is a movable pointer: whoever controls the action repository can re-point it, and the next run executes whatever it points at. Several of these actions run in jobs whose outputs ship to users: build-release.yml creates the GitHub release with the downloadable binaries, and build-windows-hosts.yml holds the SignPath signing token, so a re-pointed tag there could ship a tampered or wrongly signed release. This is exactly how the tj-actions/changed-files compromise propagated (CVE-2025-30066). Pinning by full commit SHA makes the reviewed code the code that runs, the same way docker/setup-qemu-action is already pinned in build-linux-vms.yml. Refs that pointed at master (cross-platform-actions, setup-alpine, get-latest-release) are pinned to their latest release tag. Every pin keeps a version comment, and each SHA was resolved from the upstream repository and cross-checked against its release tag. --- .github/workflows/build-dragonfly-amd64.yml | 6 +++--- .github/workflows/build-freebsd-amd64.yml | 6 +++--- .github/workflows/build-haiku-amd64.yml | 6 +++--- .github/workflows/build-linux-armv7l.yml | 6 +++--- .github/workflows/build-linux-hosts.yml | 8 ++++---- .github/workflows/build-linux-i686.yml | 4 ++-- .github/workflows/build-linux-loong64.yml | 4 ++-- .github/workflows/build-linux-vms.yml | 6 +++--- .github/workflows/build-macos-hosts.yml | 4 ++-- .github/workflows/build-musl-amd64.yml | 6 +++--- .github/workflows/build-netbsd-amd64.yml | 6 +++--- .github/workflows/build-no-features-test.yml | 2 +- .github/workflows/build-omnios-amd64.yml | 6 +++--- .github/workflows/build-openbsd-amd64.yml | 6 +++--- .github/workflows/build-release.yml | 8 ++++---- .github/workflows/build-solaris-amd64.yml | 6 +++--- .github/workflows/build-spellcheck.yml | 2 +- .github/workflows/build-windows-hosts.yml | 10 +++++----- 18 files changed, 51 insertions(+), 51 deletions(-) diff --git a/.github/workflows/build-dragonfly-amd64.yml b/.github/workflows/build-dragonfly-amd64.yml index a9e62fd0e..c4b39ecc7 100644 --- a/.github/workflows/build-dragonfly-amd64.yml +++ b/.github/workflows/build-dragonfly-amd64.yml @@ -12,10 +12,10 @@ jobs: steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Start VM - uses: cross-platform-actions/action@master + uses: cross-platform-actions/action@5ea7e8e4677bd726033a10b094ba1c5762b15dee # v1.3.0 with: operating_system: dragonflybsd version: '6.4.2' @@ -57,7 +57,7 @@ jobs: run: ctest --output-on-failure - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-dragonfly-amd64 path: ./fastfetch-*.* diff --git a/.github/workflows/build-freebsd-amd64.yml b/.github/workflows/build-freebsd-amd64.yml index a6af2cba0..ad65c808d 100644 --- a/.github/workflows/build-freebsd-amd64.yml +++ b/.github/workflows/build-freebsd-amd64.yml @@ -12,10 +12,10 @@ jobs: steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Start VM - uses: cross-platform-actions/action@master + uses: cross-platform-actions/action@5ea7e8e4677bd726033a10b094ba1c5762b15dee # v1.3.0 with: operating_system: freebsd version: '15.1' @@ -58,7 +58,7 @@ jobs: run: ctest --output-on-failure - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-freebsd-amd64 path: ./fastfetch-*.* diff --git a/.github/workflows/build-haiku-amd64.yml b/.github/workflows/build-haiku-amd64.yml index a50550af8..8b9b6cacf 100644 --- a/.github/workflows/build-haiku-amd64.yml +++ b/.github/workflows/build-haiku-amd64.yml @@ -12,10 +12,10 @@ jobs: steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Start VM - uses: cross-platform-actions/action@master + uses: cross-platform-actions/action@5ea7e8e4677bd726033a10b094ba1c5762b15dee # v1.3.0 with: operating_system: haiku version: 'r1beta5' @@ -51,7 +51,7 @@ jobs: run: ctest --output-on-failure - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-haiku-amd64 path: ./fastfetch-*.* diff --git a/.github/workflows/build-linux-armv7l.yml b/.github/workflows/build-linux-armv7l.yml index fd73e8a6f..4a1f017d6 100644 --- a/.github/workflows/build-linux-armv7l.yml +++ b/.github/workflows/build-linux-armv7l.yml @@ -11,10 +11,10 @@ jobs: runs-on: ubuntu-24.04 steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: run VM - uses: uraimo/run-on-arch-action@v3 + uses: uraimo/run-on-arch-action@f9b26e3a1a408d5fd530d20c17b9f3f4428ff8d9 # v3.1.0 id: runcmd with: arch: armv7 @@ -38,7 +38,7 @@ jobs: ctest --output-on-failure - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-linux-armv7l path: ./fastfetch-*.* diff --git a/.github/workflows/build-linux-hosts.yml b/.github/workflows/build-linux-hosts.yml index ae0cec971..e724146af 100644 --- a/.github/workflows/build-linux-hosts.yml +++ b/.github/workflows/build-linux-hosts.yml @@ -24,7 +24,7 @@ jobs: ffversion: ${{ steps.ffversion.outputs.ffversion }} steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: uname -a run: uname -a @@ -48,7 +48,7 @@ jobs: - name: Initialize CodeQL if: inputs.arch == 'amd64' - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 with: languages: c @@ -60,7 +60,7 @@ jobs: - name: perform CodeQL analysis if: inputs.arch == 'amd64' - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 - name: list features run: ./fastfetch --list-features @@ -97,7 +97,7 @@ jobs: cpack -V - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-linux-${{ inputs.arch }} path: ./fastfetch-*.* diff --git a/.github/workflows/build-linux-i686.yml b/.github/workflows/build-linux-i686.yml index ed7ab176c..3f46344f8 100644 --- a/.github/workflows/build-linux-i686.yml +++ b/.github/workflows/build-linux-i686.yml @@ -11,7 +11,7 @@ jobs: runs-on: ubuntu-22.04 steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: uname -a run: uname -a @@ -64,7 +64,7 @@ jobs: run: ctest --output-on-failure - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-linux-i686 path: ./fastfetch-*.* diff --git a/.github/workflows/build-linux-loong64.yml b/.github/workflows/build-linux-loong64.yml index 25b140d8f..7dea51795 100644 --- a/.github/workflows/build-linux-loong64.yml +++ b/.github/workflows/build-linux-loong64.yml @@ -11,7 +11,7 @@ jobs: runs-on: ubuntu-24.04 steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: set up QEMU for loong64 uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0 @@ -51,7 +51,7 @@ jobs: ' - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-linux-loong64 path: ./fastfetch-*.* diff --git a/.github/workflows/build-linux-vms.yml b/.github/workflows/build-linux-vms.yml index 49600cb5c..7a196e006 100644 --- a/.github/workflows/build-linux-vms.yml +++ b/.github/workflows/build-linux-vms.yml @@ -15,10 +15,10 @@ jobs: runs-on: ubuntu-latest steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: run VM - uses: uraimo/run-on-arch-action@v3 + uses: uraimo/run-on-arch-action@f9b26e3a1a408d5fd530d20c17b9f3f4428ff8d9 # v3.1.0 id: runcmd with: arch: ${{ inputs.arch }} @@ -39,7 +39,7 @@ jobs: ctest --output-on-failure - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-linux-${{ inputs.arch }} path: ./fastfetch-*.* diff --git a/.github/workflows/build-macos-hosts.yml b/.github/workflows/build-macos-hosts.yml index b5fa76a4e..766fad0c9 100644 --- a/.github/workflows/build-macos-hosts.yml +++ b/.github/workflows/build-macos-hosts.yml @@ -18,7 +18,7 @@ jobs: runs-on: ${{ inputs.runs-on }} steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: uname -a run: uname -a @@ -53,7 +53,7 @@ jobs: run: ctest --output-on-failure - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-macos-${{ inputs.arch }} path: ./fastfetch-*.* diff --git a/.github/workflows/build-musl-amd64.yml b/.github/workflows/build-musl-amd64.yml index 3b4fa8692..da02bcba2 100644 --- a/.github/workflows/build-musl-amd64.yml +++ b/.github/workflows/build-musl-amd64.yml @@ -10,10 +10,10 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: setup alpine linux - uses: jirutka/setup-alpine@master + uses: jirutka/setup-alpine@ae3b3ddba35054804fc4a3507b519fa7e8152050 # v1.4.1 with: branch: edge @@ -41,7 +41,7 @@ jobs: shell: alpine.sh {0} - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-musl-amd64 path: ./fastfetch-*.* diff --git a/.github/workflows/build-netbsd-amd64.yml b/.github/workflows/build-netbsd-amd64.yml index 96b0ba2cc..18b5f33a6 100644 --- a/.github/workflows/build-netbsd-amd64.yml +++ b/.github/workflows/build-netbsd-amd64.yml @@ -12,10 +12,10 @@ jobs: steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Start VM - uses: cross-platform-actions/action@master + uses: cross-platform-actions/action@5ea7e8e4677bd726033a10b094ba1c5762b15dee # v1.3.0 with: operating_system: netbsd version: '10.1' @@ -56,7 +56,7 @@ jobs: run: ctest --output-on-failure - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-netbsd-amd64 path: ./fastfetch-*.* diff --git a/.github/workflows/build-no-features-test.yml b/.github/workflows/build-no-features-test.yml index 2dc5bcd21..a301549d2 100644 --- a/.github/workflows/build-no-features-test.yml +++ b/.github/workflows/build-no-features-test.yml @@ -12,7 +12,7 @@ jobs: steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: uname -a run: uname -a diff --git a/.github/workflows/build-omnios-amd64.yml b/.github/workflows/build-omnios-amd64.yml index 2fc5f6ed5..d2e393191 100644 --- a/.github/workflows/build-omnios-amd64.yml +++ b/.github/workflows/build-omnios-amd64.yml @@ -12,10 +12,10 @@ jobs: steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Start VM - uses: cross-platform-actions/action@master + uses: cross-platform-actions/action@5ea7e8e4677bd726033a10b094ba1c5762b15dee # v1.3.0 with: operating_system: omnios version: 'r151058' @@ -61,7 +61,7 @@ jobs: cpack -V - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-omnios-amd64 path: ./fastfetch-*.* diff --git a/.github/workflows/build-openbsd-amd64.yml b/.github/workflows/build-openbsd-amd64.yml index bd400f716..c3240eb36 100644 --- a/.github/workflows/build-openbsd-amd64.yml +++ b/.github/workflows/build-openbsd-amd64.yml @@ -12,10 +12,10 @@ jobs: steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Start VM - uses: cross-platform-actions/action@master + uses: cross-platform-actions/action@5ea7e8e4677bd726033a10b094ba1c5762b15dee # v1.3.0 with: operating_system: openbsd version: '7.9' @@ -56,7 +56,7 @@ jobs: run: ctest --output-on-failure - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-openbsd-amd64 path: ./fastfetch-*.* diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml index 670286d20..7af70e83d 100644 --- a/.github/workflows/build-release.yml +++ b/.github/workflows/build-release.yml @@ -13,17 +13,17 @@ jobs: steps: - name: get latest release version id: get_version_release - uses: pozetroninc/github-action-get-latest-release@master + uses: pozetroninc/github-action-get-latest-release@2a61c339ea7ef0a336d1daa35ef0cb1418e7676c # v0.8.0 with: repository: ${{ github.repository }} - name: download artifacts if: inputs.ffversion != steps.get_version_release.outputs.release - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 - name: create release if: inputs.ffversion != steps.get_version_release.outputs.release - uses: ncipollo/release-action@v1 + uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0 with: tag: ${{ inputs.ffversion }} commit: ${{ github.sha }} @@ -50,7 +50,7 @@ jobs: - name: update release body if: inputs.ffversion != steps.get_version_release.outputs.release - uses: ncipollo/release-action@v1 + uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0 with: tag: ${{ inputs.ffversion }} commit: ${{ github.sha }} diff --git a/.github/workflows/build-solaris-amd64.yml b/.github/workflows/build-solaris-amd64.yml index fd5e75894..806c64df2 100644 --- a/.github/workflows/build-solaris-amd64.yml +++ b/.github/workflows/build-solaris-amd64.yml @@ -11,10 +11,10 @@ jobs: runs-on: ubuntu-latest steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: run VM - uses: vmactions/solaris-vm@v1 + uses: vmactions/solaris-vm@315163f088b66e55bbcc45928bd224d4973b2312 # v1.3.8 with: usesh: true envs: 'CMAKE_BUILD_TYPE' @@ -37,7 +37,7 @@ jobs: cpack -V - name: upload artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-solaris-amd64 path: ./fastfetch-*.* diff --git a/.github/workflows/build-spellcheck.yml b/.github/workflows/build-spellcheck.yml index ade30a6ce..da6443e28 100644 --- a/.github/workflows/build-spellcheck.yml +++ b/.github/workflows/build-spellcheck.yml @@ -9,7 +9,7 @@ jobs: steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install codespell shell: bash diff --git a/.github/workflows/build-windows-hosts.yml b/.github/workflows/build-windows-hosts.yml index b2bb9c0eb..f36e007e0 100644 --- a/.github/workflows/build-windows-hosts.yml +++ b/.github/workflows/build-windows-hosts.yml @@ -30,10 +30,10 @@ jobs: shell: msys2 {0} steps: - name: checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: setup-msys2 - uses: msys2/setup-msys2@v2 + uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0 with: msystem: ${{ inputs.msystem }} update: true @@ -72,7 +72,7 @@ jobs: - if: github.event_name == 'push' && github.repository == 'fastfetch-cli/fastfetch' id: upload-unsigned-artifact name: upload artifacts for signing - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-windows-${{ inputs.arch }} path: | @@ -82,7 +82,7 @@ jobs: - if: github.event_name == 'push' && github.repository == 'fastfetch-cli/fastfetch' name: submit signing request - uses: signpath/github-action-submit-signing-request@v1 + uses: signpath/github-action-submit-signing-request@ced31329c0317e779dad2eec2a7c3bb46ea1343e # v1.3 with: api-token: '${{ secrets.SIGNPATH_API_TOKEN }}' organization-id: '${{ vars.SIGNPATH_ORG_ID }}' @@ -99,7 +99,7 @@ jobs: run: 7z a -t7z -mx9 -bd -y fastfetch-windows-${{ inputs.arch }}.7z LICENSE *.dll fastfetch.exe flashfetch.exe presets - name: upload true artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fastfetch-windows-${{ inputs.arch }} path: ./fastfetch-windows-${{ inputs.arch }}.*