pipe-cd / pipe-cd/pipecd

Backport workflow-hardening fix (unpinned-uses) to 5 release branches

Open

#6,941 opened on Jun 29, 2026 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language: Go
Stars: 1.4k
Forks: 364
Avg merge: 1d 4h
Merged PRs (30d): 84

Description

Summary

The default branch already hardened .github/workflows/build_tool.yaml against the issue(s) below, but 5 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)

unpinned-uses — actions referenced by mutable tag/branch instead of a pinned commit SHA

Already resolved on the default branch in:

https://github.com/pipe-cd/pipecd/commit/4e74757d99a34378f1c6141ff8ff56f7f0ab4c12

Affected release branches (5)

release-v0.48.x (still present as of HEAD 2f57e0ab)
release-v0.50.x (still present as of HEAD ef960273)
release-v0.49.x (still present as of HEAD af2d2270)
release-v0.47.x (still present as of HEAD ee2011f6)
release-v0.46.x (still present as of HEAD e57ade14)

Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

release-v0.48.x — unpinned-uses

File .github/workflows/build_tool.yaml; suggested edits:

- jobs.$J.steps[uses=docker/setup-buildx-action].uses = 'docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349'
- jobs.$J.steps[uses=docker/setup-qemu-action].uses = 'docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf'
~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
~ jobs.$J.steps[uses=docker/build-push-action].uses : pin(docker/build-push-action -> target_ref SHA)

--- a/.github/workflows/build_tool.yaml
+++ b/.github/workflows/build_tool.yaml
@@ -24,7 +24,7 @@
           - piped-base-okd
           - firestore-emulator
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3
         with:
           fetch-depth: 0
       - name: Determine version

release-v0.50.x — unpinned-uses

File .github/workflows/build_tool.yaml; suggested edits:

- jobs.$J.steps[uses=docker/setup-buildx-action].uses = 'docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349'
- jobs.$J.steps[uses=docker/setup-qemu-action].uses = 'docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf'
~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
~ jobs.$J.steps[uses=docker/build-push-action].uses : pin(docker/build-push-action -> target_ref SHA)

--- a/.github/workflows/build_tool.yaml
+++ b/.github/workflows/build_tool.yaml
@@ -24,7 +24,7 @@
           - piped-base-okd
           - firestore-emulator
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3
         with:
           fetch-depth: 0
       - name: Determine version

release-v0.49.x — unpinned-uses

File .github/workflows/build_tool.yaml; suggested edits:

- jobs.$J.steps[uses=docker/setup-buildx-action].uses = 'docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349'
- jobs.$J.steps[uses=docker/setup-qemu-action].uses = 'docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf'
~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
~ jobs.$J.steps[uses=docker/build-push-action].uses : pin(docker/build-push-action -> target_ref SHA)

--- a/.github/workflows/build_tool.yaml
+++ b/.github/workflows/build_tool.yaml
@@ -24,7 +24,7 @@
           - piped-base-okd
           - firestore-emulator
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3
         with:
           fetch-depth: 0
       - name: Determine version

release-v0.47.x — unpinned-uses

File .github/workflows/build_tool.yaml; suggested edits:

- jobs.$J.steps[uses=docker/setup-buildx-action].uses = 'docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349'
- jobs.$J.steps[uses=docker/setup-qemu-action].uses = 'docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf'
~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
~ jobs.$J.steps[uses=docker/build-push-action].uses : pin(docker/build-push-action -> target_ref SHA)

--- a/.github/workflows/build_tool.yaml
+++ b/.github/workflows/build_tool.yaml
@@ -23,7 +23,7 @@
           - piped-base-okd
           - firestore-emulator
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3
         with:
           fetch-depth: 0
       - name: Determine version

release-v0.46.x — unpinned-uses

File .github/workflows/build_tool.yaml; suggested edits:

- jobs.$J.steps[uses=docker/setup-buildx-action].uses = 'docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349'
- jobs.$J.steps[uses=docker/setup-qemu-action].uses = 'docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf'
~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
~ jobs.$J.steps[uses=docker/build-push-action].uses : pin(docker/build-push-action -> target_ref SHA)

--- a/.github/workflows/build_tool.yaml
+++ b/.github/workflows/build_tool.yaml
@@ -23,7 +23,7 @@
           - piped-base-okd
           - firestore-emulator
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3
         with:
           fetch-depth: 0
       - name: Determine version

Happy to open pull requests instead if that's preferred.

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Research direction

Start with .github/workflows/build_tool.yaml on each of the five listed release branches and compare it with the default-branch fix at commit 4e74757d99a34378f1c6141ff8ff56f7f0ab4c12. Apply the documented action pinning changes, then run zizmor and actionlint for each branch. Done means the unpinned-uses findings are cleared without new findings.

Written by the indexing model from the issue text.

Assessment

Tech stack: github-actions, yaml
Domain: ci-cd, devops, security
Issue type: Bug
Difficulty: 3/5
Estimated time: 1-2 days
Activity status: Quiet
Clarity: Clearly specified
Newbie friendliness: 62/100

A short digest of beginner-friendly GitHub issues.