Skip to content

Pin privileged release actions and document custody #166

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
gontzess wants to merge 12 commits into from
Draft

Pin privileged release actions and document custody #166

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
e20da1c
Enforce pinned action policy in privileged release jobs
gontzess Oct 22, 2026
8f77768
Cover first-party subactions and inherited release secrets
gontzess Oct 22, 2026
afabc58
Recognize bracket and whole-context secret references
gontzess Oct 22, 2026
56442bd
Clarify failure notification event and metric behavior
gontzess Oct 22, 2026
32533b4
Bound failure reporting and reject overwritten workflow bootstraps
gontzess Oct 22, 2026
ae409b7
Invalidate bootstrap readiness for root and unresolvable checkouts
gontzess Oct 22, 2026
a72f290
Clarify best-effort notification failure rationale
gontzess Oct 22, 2026
9742d3d
Retain the pinned Datadog notification survivor
gontzess Oct 22, 2026
d20de4f
Document manual workflow action re-pinning
gontzess Oct 22, 2026
253c7f4
Clarify manual action re-pinning and remove unrelated assertion
gontzess Oct 22, 2026
cb85b31
Keep release action pins and concise custody documentation
gontzess Oct 22, 2026
6583b65
Describe Datadog notification as event-only
gontzess Oct 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 18 additions & 16 deletions .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -422,7 +422,7 @@ jobs:
tools: go,gon,syft,goreleaser

- name: Checkout caller repo
uses: actions/checkout@v5
uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
with:
path: _caller
repository: ${{ github.event.repository.full_name }}
Expand Down Expand Up @@ -496,13 +496,13 @@ jobs:
envsubst < templates/.slsa-provenance-predicate-template.json.tmpl | tee "${GENERATED_DIR}/predicate.json"

- name: Import Keychain Certs
uses: apple-actions/import-codesign-certs@v1
uses: apple-actions/import-codesign-certs@253ddeeac23f2bdad1646faac5c8c2832e800071 # v1
with:
p12-file-base64: ${{ secrets.APPLE_SIGNING_KEY_P12 }}
p12-password: ${{ secrets.APPLE_SIGNING_KEY_P12_PASSWORD }}

- name: Configure AWS credentials via OIDC
uses: aws-actions/configure-aws-credentials@v5
uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5
with:
role-to-assume: arn:aws:iam::025044153841:role/${{ steps.role-names.outputs.gha_artifacts_role_name }}
aws-region: us-west-2
Expand Down Expand Up @@ -745,7 +745,7 @@ jobs:
run: git config --system core.longpaths true

- name: Checkout caller repo
uses: actions/checkout@v5
uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
with:
path: _caller
repository: ${{ github.event.repository.full_name }}
Expand Down Expand Up @@ -942,7 +942,7 @@ jobs:
ls "${CALLER_DIST}"/*.sbom.sigstore.json

- name: Configure AWS credentials via OIDC
uses: aws-actions/configure-aws-credentials@v5
uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5
with:
role-to-assume: arn:aws:iam::025044153841:role/${{ steps.role-names.outputs.gha_artifacts_role_name }}
aws-region: us-west-2
Expand Down Expand Up @@ -1024,7 +1024,7 @@ jobs:
tools: go,goreleaser

- name: Checkout caller repo
uses: actions/checkout@v5
uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
with:
path: _caller
repository: ${{ github.event.repository.full_name }}
Expand Down Expand Up @@ -1146,7 +1146,7 @@ jobs:

- name: Set up QEMU
if: inputs.docker == true || inputs.lambda == true
uses: docker/setup-qemu-action@v3
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
with:
platforms: linux/arm64
image: tonistiigi/binfmt@sha256:400a4873b838d1b89194d982c45e5fb3cda4593fbfd7e08a02e76b03b21166f0
Expand All @@ -1157,14 +1157,14 @@ jobs:

- name: Configure Public ECR AWS credentials via OIDC
if: inputs.docker == true
uses: aws-actions/configure-aws-credentials@v5
uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5
with:
role-to-assume: arn:aws:iam::025044153841:role/${{ steps.role-names.outputs.gha_artifacts_role_name }}
aws-region: us-east-1

- name: Login to Public ECR
if: inputs.docker == true
uses: aws-actions/amazon-ecr-login@v2
uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2
with:
registry-type: public

Expand Down Expand Up @@ -1196,14 +1196,14 @@ jobs:

- name: Configure Lambda ECR AWS credentials via OIDC
if: inputs.lambda == true
uses: aws-actions/configure-aws-credentials@v5
uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5
with:
role-to-assume: "arn:aws:iam::168442440833:role/${{ steps.role-names.outputs.ecr_push_role_name }}"
aws-region: us-west-2

- name: Login to Lambda ECR
if: inputs.lambda == true
uses: aws-actions/amazon-ecr-login@v2
uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2

- name: Run GoReleaser for Lambda
if: inputs.lambda == true
Expand Down Expand Up @@ -1361,7 +1361,7 @@ jobs:
cosign-release: v2.5.2

- name: Configure AWS credentials via OIDC
uses: aws-actions/configure-aws-credentials@v5
uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5
with:
role-to-assume: arn:aws:iam::025044153841:role/${{ steps.role-names.outputs.gha_artifacts_role_name }}
aws-region: us-west-2
Expand Down Expand Up @@ -1582,7 +1582,7 @@ jobs:
tools: go

- name: Checkout connector repo
uses: actions/checkout@v5
uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
with:
path: _connector
repository: ${{ github.event.repository.full_name }}
Expand Down Expand Up @@ -1618,7 +1618,7 @@ jobs:

- name: Get GitHub OIDC token for registry API
id: registry-oidc
uses: actions/github-script@v7
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
with:
script: |
const token = await core.getIDToken('connector-registry')
Expand Down Expand Up @@ -1752,14 +1752,14 @@ jobs:
# anonymous rate limit, which shared runner addresses exhaust.
- name: Configure Public ECR AWS credentials via OIDC
if: inputs.docker == true
uses: aws-actions/configure-aws-credentials@v5
uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5
with:
role-to-assume: arn:aws:iam::025044153841:role/GHA-PublicECRPull
aws-region: us-east-1

- name: Login to Public ECR
if: inputs.docker == true
uses: aws-actions/amazon-ecr-login@v2
uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2
with:
registry-type: public

Expand Down Expand Up @@ -1789,6 +1789,7 @@ jobs:
actions: read
contents: read
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- name: Collect failure annotations
id: collect-ann
Expand Down Expand Up @@ -1849,6 +1850,7 @@ jobs:
} >> "$GITHUB_OUTPUT"

- name: Send Datadog event on failure
continue-on-error: true # best-effort reporting: a Datadog failure does not fail this job (the workflow is already failed)
uses: masci/datadog@93a16378298f4e1980f13f6b412c0b8e66b96185 # v1
with:
api-key: ${{ secrets.DATADOG_API_KEY }}
Expand Down
16 changes: 16 additions & 0 deletions docs/release-workflow.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -276,6 +276,22 @@ Tool-using jobs set `GOTOOLCHAIN=local` at job scope. The binaries job also sets
`GOSUMDB=sum.golang.org` at job scope. Cosign and bundled-buildx/QEMU setup run
after trust/tool bootstrap and before their signing or AWS credentials.

### Pinned Release Action Custody

Review and organization Actions policy own action drift. Custody below describes

@github-actions github-actions Bot Oct 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Suggestion (confidence: high): This push deleted scripts/check-release-actions.py, tools/privileged-actions.txt and scripts/test-release-actions.py, and dropped the test from make test-scripts. Repository CI no longer enforces the pins. The PR title ("Enforce pinned action allowlist") and body ("make action-policy drift fail repository CI", the evidence list, the negative controls) still describe that checker. Please update the title and description to match what this PR does now: one-time SHA pins plus documentation, with drift left to review and org Actions policy.

explicit inputs; job-scoped credentials remain available according to permissions.

| Action | SHA | Which job | Custody |
| --- | --- | --- | --- |
| actions/checkout | `fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09` | All jobs except notify-release-failure; locked-tools gon checkout | Job-scoped `GITHUB_TOKEN`; `persist-credentials: false`. |
| actions/github-script | `f28e40c7f34bde8b3046d885e986cb6290c5673b` | record-registry-api | Job OIDC credentials; masked registry-audience token output. |
| sigstore/cosign-installer | `398d4b0eeef1380460a10c8013a76f728fb906ac` | goreleaser-binaries, goreleaser-windows, goreleaser-docker, publish-release-manifest, verify-release | Tool bootstrap in OIDC-enabled jobs; no explicit secret input. |
| apple-actions/import-codesign-certs | `253ddeeac23f2bdad1646faac5c8c2832e800071` | goreleaser-binaries | Step inputs `APPLE_SIGNING_KEY_P12` and `APPLE_SIGNING_KEY_P12_PASSWORD`. |
| aws-actions/configure-aws-credentials | `61815dcd50bd041e203e49132bacad1fd04d2708` | goreleaser-binaries, goreleaser-windows, goreleaser-docker, publish-release-manifest, verify-release | Exchanges job OIDC for scoped AWS role credentials. |
| aws-actions/amazon-ecr-login | `03f1aad4c6c7ffd436567f42f9384779290529bd` | goreleaser-docker, verify-release | Job AWS credentials; registry authentication for publishing or pulling. |
| docker/setup-qemu-action | `c7c53464625b32c7a7e944ae62b3e17d2b600130` | goreleaser-docker | Digest-pinned binfmt setup in an OIDC-enabled job; no explicit secret input. |
| masci/datadog | `93a16378298f4e1980f13f6b412c0b8e66b96185` | notify-release-failure | `DATADOG_API_KEY` (Datadog org write key), only step `with: api-key`; non-signing, notification only. Best-effort (`continue-on-error: true`), five-minute job; event-only. Re-pin review: diff the action's tag-to-SHA source; re-pinning is manual (no Renovate tracking exists for workflow SHAs). |

### Locked Release Tools

`.github/actions/locked-tools/tool-locks.txt` identifies tool versions, artifact
Expand Down
Loading