Guardrails / pipeline

Pipeline steps pin the code they run

pipeline/actions-pinned-by-digest@v1

Every third party action a workflow uses is pinned to a full commit sha rather than to a tag or a branch.

Id	pipeline/actions-pinned-by-digest
Version	v1
Category	pipeline
Default severity	error
Interpreter	python3
Timeout	30 seconds
Violations tolerated	0
Collects	workflow

Collectors

This guardrail gathers nothing itself. It depends on the collectors below, which the CLI runs once per build before any check, and reads what they found out of GUARDRAIL_FACTS. A collector that collects nothing skips this guardrail rather than failing it.

Collector	Gathers	Inputs it is given
workflow	The pipeline definitions in the checkout, read as they are written: which triggers start them, what permissions they hand a job, which runner each job asks for, and every action a step reaches for and how tightly it is pinned. Names and shapes only, never a secret, an input value or an environment value.	pipelines

The inputs above are this guardrail's own, passed straight through. Configuring one in buildnote.json changes what is collected, and two guardrails configured the same way share the one collection.

Configuration

{
  "guardrails": {
      "failOn": "error",
      "comment": true,
      "checks": [
          {
              "use": "pipeline/actions-pinned-by-digest@v1",
              "severity": "error",
              "with": {
                  "pipelines": ".github/workflows/*.yml,.github/workflows/*.yaml,.gitlab-ci.yml,azure-pipelines*.yml,Jenkinsfile",
                  "allow": ""
              },
              "exemptions": []
          }
      ]
  }
}

Inputs

Input	Description	Default	Environment variable
pipelines	Comma separated globs naming the pipeline definitions to read.	.github/workflows/*.yml,.github/workflows/*.yaml,.gitlab-ci.yml,azure-pipelines*.yml,Jenkinsfile	GUARDRAIL_INPUT_PIPELINES
allow	Comma separated action names exempt from pinning, for the ones your own organisation publishes. actions/* is a glob.	``	GUARDRAIL_INPUT_ALLOW

How to fix

Replace the tag with the commit sha it points at today, keeping the tag beside it so a human can still read the version:

- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

A tag is a moving pointer that whoever owns the action can repoint at any time, so a pipeline that trusts one runs whatever that account decides to publish, with your secrets in scope. dependabot and renovate both understand this form and will keep raising the sha for you.

More in pipeline

• pipeline/job-timeout-set. Every job declares how long it may run, so a hung job is cut off rather than holding a runner until the platform's own limit.
• pipeline/least-privilege-token. Every workflow declares permissions, and none of them takes write access to everything.
• pipeline/no-script-injection. No run step interpolates a ${{ }} expression an outsider controls, such as a pull request title or a branch name, straight into the shell body.
• pipeline/no-untrusted-checkout. No workflow triggered by pull_request_target, issue_comment or workflow_run checks out a revision of its own choosing, or passes the request's revision into a command.

All 5 pipeline guardrails