tensorflow / tensorflow/tensorboard

Backport workflow-hardening fix (unpinned-uses) to 3 release branches

Open
#7,137 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
7.2k
Forks
1.7k
Avg merge
4d 22h
Merged PRs (30d)
1

Description

Summary

The default branch already hardened .github/workflows/ci.yml against the issue(s) below, but 3 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)
  • unpinned-uses — actions referenced by mutable tag/branch instead of a pinned commit SHA

Already resolved on the default branch in:

Affected release branches (3)
  • 2.21 (still present as of HEAD 6feb9c90)
  • 2.20 (still present as of HEAD 474d3eef)
  • 2.19 (still present as of HEAD 3fceda6d)
Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

2.21 — unpinned-uses

File .github/workflows/ci.yml; suggested edits:

  • ~ jobs.$J2.steps[uses=actions-rs/toolchain].uses : pin(actions-rs/toolchain -> target_ref SHA)
  • ~ jobs.$J2.steps[uses=actions/cache].uses : pin(actions/cache -> target_ref SHA)
  • ~ jobs.$J2.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J2.steps[uses=actions/setup-python].uses : pin(actions/setup-python -> target_ref SHA)
  • ~ jobs.$J2.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)
  • ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J.steps[uses=actions/setup-python].uses : pin(actions/setup-python -> target_ref SHA)
  • ~ jobs.$J3.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J3.steps[uses=actions/setup-node].uses : pin(actions/setup-node -> target_ref SHA)
  • ~ jobs.$J4.steps[uses=DoozyX/clang-format-lint-action].uses : pin(DoozyX/clang-format-lint-action -> target_ref SHA)
  • ~ jobs.$J4.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J5.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J5.steps[uses=actions/setup-python].uses : pin(actions/setup-python -> target_ref SHA)
  • ~ jobs.$J6.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J6.steps[uses=actions/setup-python].uses : pin(actions/setup-python -> target_ref SHA)
  • ~ jobs.$J7.steps[uses=actions-rs/clippy-check].uses : pin(actions-rs/clippy-check -> target_ref SHA)
  • ~ jobs.$J7.steps[uses=actions-rs/toolchain].uses : pin(actions-rs/toolchain -> target_ref SHA)
  • ~ jobs.$J7.steps[uses=actions/cache].uses : pin(actions/cache -> target_ref SHA)
  • ~ jobs.$J7.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -188,7 +188,7 @@
           architecture: 'x64'
       - name: 'Cache Cargo artifacts'
         if: matrix.mode == 'native'
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
         with:
           path: |
             tensorboard/data/server/target/
@@ -239,7 +239,7 @@
             --out-dir /tmp/pip_package \
             ;
       - name: 'Upload'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         with:
           name: tensorboard-data-server_${{ matrix.mode }}_${{ matrix.platform }}_${{ matrix.rust_version }}
           path: /tmp/pip_package/*
@@ -307,7 +307,7 @@
     steps:
       - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
       - name: 'Cache Cargo artifacts'
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
         with:
           path: |
             tensorboard/data/server/target/
2.20 — unpinned-uses

File .github/workflows/ci.yml; suggested edits:

  • ~ jobs.$J2.steps[uses=actions-rs/toolchain].uses : pin(actions-rs/toolchain -> target_ref SHA)
  • ~ jobs.$J2.steps[uses=actions/cache].uses : pin(actions/cache -> target_ref SHA)
  • ~ jobs.$J2.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J2.steps[uses=actions/setup-python].uses : pin(actions/setup-python -> target_ref SHA)
  • ~ jobs.$J2.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)
  • ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J.steps[uses=actions/setup-python].uses : pin(actions/setup-python -> target_ref SHA)
  • ~ jobs.$J3.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J3.steps[uses=actions/setup-node].uses : pin(actions/setup-node -> target_ref SHA)
  • ~ jobs.$J4.steps[uses=DoozyX/clang-format-lint-action].uses : pin(DoozyX/clang-format-lint-action -> target_ref SHA)
  • ~ jobs.$J4.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J5.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J5.steps[uses=actions/setup-python].uses : pin(actions/setup-python -> target_ref SHA)
  • ~ jobs.$J6.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J6.steps[uses=actions/setup-python].uses : pin(actions/setup-python -> target_ref SHA)
  • ~ jobs.$J7.steps[uses=actions-rs/clippy-check].uses : pin(actions-rs/clippy-check -> target_ref SHA)
  • ~ jobs.$J7.steps[uses=actions-rs/toolchain].uses : pin(actions-rs/toolchain -> target_ref SHA)
  • ~ jobs.$J7.steps[uses=actions/cache].uses : pin(actions/cache -> target_ref SHA)
  • ~ jobs.$J7.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -160,7 +160,7 @@
           architecture: 'x64'
       - name: 'Cache Cargo artifacts'
         if: matrix.mode == 'native'
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
         with:
           path: |
             tensorboard/data/server/target/
@@ -211,7 +211,7 @@
             --out-dir /tmp/pip_package \
             ;
       - name: 'Upload'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         with:
           name: tensorboard-data-server_${{ matrix.mode }}_${{ matrix.platform }}_${{ matrix.rust_version }}
           path: /tmp/pip_package/*
@@ -279,7 +279,7 @@
     steps:
       - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
       - name: 'Cache Cargo artifacts'
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
         with:
           path: |
             tensorboard/data/server/target/
2.19 — unpinned-uses

File .github/workflows/ci.yml; suggested edits:

  • ~ jobs.$J2.steps[uses=actions-rs/toolchain].uses : pin(actions-rs/toolchain -> target_ref SHA)
  • ~ jobs.$J2.steps[uses=actions/cache].uses : pin(actions/cache -> target_ref SHA)
  • ~ jobs.$J2.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J2.steps[uses=actions/setup-python].uses : pin(actions/setup-python -> target_ref SHA)
  • ~ jobs.$J2.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)
  • ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J.steps[uses=actions/setup-python].uses : pin(actions/setup-python -> target_ref SHA)
  • ~ jobs.$J3.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J3.steps[uses=actions/setup-node].uses : pin(actions/setup-node -> target_ref SHA)
  • ~ jobs.$J4.steps[uses=DoozyX/clang-format-lint-action].uses : pin(DoozyX/clang-format-lint-action -> target_ref SHA)
  • ~ jobs.$J4.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J5.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J5.steps[uses=actions/setup-python].uses : pin(actions/setup-python -> target_ref SHA)
  • ~ jobs.$J6.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
  • ~ jobs.$J6.steps[uses=actions/setup-python].uses : pin(actions/setup-python -> target_ref SHA)
  • ~ jobs.$J7.steps[uses=actions-rs/clippy-check].uses : pin(actions-rs/clippy-check -> target_ref SHA)
  • ~ jobs.$J7.steps[uses=actions-rs/toolchain].uses : pin(actions-rs/toolchain -> target_ref SHA)
  • ~ jobs.$J7.steps[uses=actions/cache].uses : pin(actions/cache -> target_ref SHA)
  • ~ jobs.$J7.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -211,7 +211,7 @@
             --out-dir /tmp/pip_package \
             ;
       - name: 'Upload'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         with:
           name: tensorboard-data-server_${{ matrix.mode }}_${{ matrix.platform }}_${{ matrix.rust_version }}
           path: /tmp/pip_package/*

Happy to open pull requests instead if that's preferred.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with .github/workflows/ci.yml on release branches 2.21, 2.20, and 2.19, comparing each with the default-branch fix at commit 1501f462ad61eba0a8b93910d3995e50fbaab784. Apply the listed action pinning changes for each branch, then run zizmor and actionlint. Done means the unpinned-uses findings are cleared without new lint or security findings.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions
Domain
ci-cd, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.