Recent supply chain attacks through github workflow (e.g. trivy) shows that we need to harden our github workflow implementation. This should apply to all subprojects of Iceberg.
I've already added a few improvements, including
I think we can do more by pinning ALL github actions to commit SHA (allowlisted by infrastructure-actions)
And enforce this for all github workflow definitions going forward.
Proposed Next Steps
-
Pin all GitHub Actions to a full commit SHA rather than mutable tags (e.g., actions/checkout@v3), using only actions allowlisted by apache/infrastructure-actions. Pinning to a SHA ensures that a compromised or modified tag cannot silently swap in malicious code.
-
Enforce SHA pinning going forward via CI checks or linting on all new and modified workflow files, so the policy is maintained consistently across contributions.
-
Disable Dependabot auto-updates for GitHub Actions. Dependabot may automatically bump action versions that have not yet been reviewed and allowlisted by ASF Infrastructure. Until an action is on the allowlist, using it will cause workflows to silently fail with no notifications (see infrastructure-actions#574). Any action version updates should go through the ASF allowlist process first.
Recent supply chain attacks through github workflow (e.g. trivy) shows that we need to harden our github workflow implementation. This should apply to all subprojects of Iceberg.
I've already added a few improvements, including
I think we can do more by pinning ALL github actions to commit SHA (allowlisted by infrastructure-actions)
And enforce this for all github workflow definitions going forward.
Proposed Next Steps
Pin all GitHub Actions to a full commit SHA rather than mutable tags (e.g.,
actions/checkout@v3), using only actions allowlisted by apache/infrastructure-actions. Pinning to a SHA ensures that a compromised or modified tag cannot silently swap in malicious code.Enforce SHA pinning going forward via CI checks or linting on all new and modified workflow files, so the policy is maintained consistently across contributions.
Disable Dependabot auto-updates for GitHub Actions. Dependabot may automatically bump action versions that have not yet been reviewed and allowlisted by ASF Infrastructure. Until an action is on the allowlist, using it will cause workflows to silently fail with no notifications (see infrastructure-actions#574). Any action version updates should go through the ASF allowlist process first.