ci: pin remaining GitHub Actions to commit SHAs by RainbowMango · Pull Request #7336 · karmada-io/karmada

RainbowMango · 2026-03-31T02:25:08Z

This hardens workflow supply-chain security and improves reproducibility.

What type of PR is this?

/kind cleanup

What this PR does / why we need it:

This pull request updates all GitHub Actions workflow files to use specific commit SHAs for third-party actions instead of version tags. This change improves the security and reliability of the CI/CD pipeline by ensuring that the workflows use immutable, reviewed versions of each action, preventing unexpected changes from upstream updates.

These changes help prevent supply chain attacks and ensure that CI builds are reproducible and predictable.

Which issue(s) this PR fixes:
Fixes #7314

Special notes for your reviewer:
This is a follow-up of #7316 and a replacement of #5396

Does this PR introduce a user-facing change?:

NONE

gemini-code-assist · 2026-03-31T02:25:14Z

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

Copilot

Pull request overview

This PR hardens CI supply-chain security by pinning third-party GitHub Actions references in workflows to immutable commit SHAs (instead of floating tags/branches), improving reproducibility and reducing exposure to upstream tag retargeting incidents (e.g., the Trivy compromise in #7314).

Changes:

Replaced uses: owner/action@<tag> references across workflows with uses: owner/action@<commit_sha>.
Pinned additional third-party actions used for releases, artifact handling, image publishing, scanning, and e2e pipelines.
Added inline comments annotating the original tag/version next to the pinned SHA.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
.github/workflows/update-helm-index.yml	Pins checkout + helm setup actions to SHAs for helm index publishing workflow.
.github/workflows/swr-released-image.yml	Pins checkout + setup-go actions for SWR release image workflow.
.github/workflows/swr-latest-image.yml	Pins checkout + setup-go actions for SWR latest image workflow.
.github/workflows/release.yml	Pins multiple release/provenance-related actions (checkout, setup-go, artifacts, GH release, SLSA generator, etc.).
.github/workflows/installation-operator.yaml	Pins free-disk-space, checkout, setup-go, artifact upload actions for operator install/e2e.
.github/workflows/installation-cli.yaml	Pins free-disk-space, checkout, setup-go, artifact upload actions for CLI install/e2e.
.github/workflows/installation-chart.yaml	Pins actions used in chart installation/testing (checkout, setup-go, helm/kustomize/python, chart-testing).
.github/workflows/fossa.yml	Pins checkout and FOSSA action for license/compliance scanning.
.github/workflows/dockerhub-released-image.yml	Pins actions used for DockerHub released-image publishing (checkout, setup-go, cosign, qemu/buildx, login).
.github/workflows/dockerhub-released-chart.yml	Pins actions used for DockerHub released-chart publishing (checkout, setup-go, login).
.github/workflows/dockerhub-latest-image.yml	Pins actions used for DockerHub latest-image publishing (checkout, setup-go, cosign, qemu/buildx, login).
.github/workflows/dockerhub-latest-chart.yml	Pins actions used for DockerHub latest-chart publishing (checkout, setup-go, login).
.github/workflows/ci.yml	Pins core CI actions (checkout, setup-go, protoc setup, codecov, artifacts, free-disk-space).
.github/workflows/ci-schedule.yml	Pins scheduled CI actions (free-disk-space, checkout, setup-go, retry, artifacts).
.github/workflows/ci-schedule-compatibility.yaml	Pins scheduled compatibility workflow actions (free-disk-space, checkout, setup-go, retry, artifacts).
.github/workflows/ci-performance-compare.yaml	Pins actions for perf comparison workflow (free-disk-space, checkout, setup-go, artifacts download/upload).
.github/workflows/ci-image-scanning.yaml	Pins actions for image scanning workflow (checkout, setup-go, SARIF upload).
.github/workflows/ci-image-scanning-on-schedule.yml	Pins actions for scheduled image scanning workflow (checkout, setup-go, SARIF upload).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-31T02:28:08Z

.github/workflows/release.yml

      actions: read # for detecting the Github Actions environment
      id-token: write # Needed for provenance signing and ID
      contents: write #  Needed for release uploads
    # Must be referenced by a tag. https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#referencing-the-slsa-generator


The inline documentation says the SLSA generator workflow "must be referenced by a tag", but this PR switches the reference to a commit SHA. Either update the comment to reflect that pinning by SHA is intentional/allowed (or revert to a tag if the upstream requirement is strict) to avoid misleading future edits.

Suggested change

# Must be referenced by a tag. https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#referencing-the-slsa-generator

# Pinned to the commit corresponding to tag v2.1.0 for security. See: https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#referencing-the-slsa-generator

I‘ll take a look at this inline documentation

https://github.com/slsa-framework/slsa-github-generator/blob/main/README.md#referencing-slsa-builders-and-generators

Related issue:
slsa-framework/slsa-verifier#12
slsa-framework/slsa-github-generator#4440

Thanks. I've reverted this change and kept it unchanged.

Given this is the only GitHub Action that doesn't pin to a SHA, and there is an ongoing effort from the slsa-framework community (slsa-framework/slsa-verifier#12), I suggest opening an issue to track this. Once the upstream support pinned version, we should update it accordingly.

OK. Please help to create the issue.

.github/workflows/release.yml

.github/workflows/fossa.yml

codecov-commenter · 2026-03-31T02:42:01Z

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 42.01%. Comparing base (d236c11) to head (42346bc).
⚠️ Report is 4 commits behind head on master.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #7336      +/-   ##
==========================================
- Coverage   42.03%   42.01%   -0.02%     
==========================================
  Files         874      874              
  Lines       53551    53556       +5     
==========================================
- Hits        22511    22504       -7     
- Misses      29349    29360      +11     
- Partials     1691     1692       +1

Flag	Coverage Δ
unittests	`42.01% <ø> (-0.02%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copilot

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

.github/workflows/release.yml

This hardens workflow supply-chain security and improves reproducibility. Signed-off-by: RainbowMango <qdurenhongcai@gmail.com>

zhzhuang-zju · 2026-03-31T06:27:43Z

/gemini review

gemini-code-assist · 2026-03-31T06:27:49Z

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

Copilot

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

zhzhuang-zju · 2026-03-31T08:32:46Z

@RainbowMango Any more updates? If it's ready, let's merge.

RainbowMango · 2026-03-31T08:44:43Z

Yes, let's do it.

zhzhuang-zju · 2026-03-31T08:45:51Z

/lgtm
/approve

karmada-bot · 2026-03-31T08:46:04Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: zhzhuang-zju

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~.github/workflows/OWNERS~~ [zhzhuang-zju]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Copilot AI review requested due to automatic review settings March 31, 2026 02:25

karmada-bot added the kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. label Mar 31, 2026

karmada-bot requested review from chaosi-zju and jwcesign March 31, 2026 02:25

karmada-bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Mar 31, 2026

Copilot started reviewing on behalf of RainbowMango March 31, 2026 02:25 View session

Copilot AI reviewed Mar 31, 2026

View reviewed changes

RainbowMango force-pushed the pr_pin_all_action_sha branch from 7b14981 to 4fc4663 Compare March 31, 2026 02:52

RainbowMango requested a review from Copilot March 31, 2026 02:58

Copilot started reviewing on behalf of RainbowMango March 31, 2026 02:58 View session

Copilot AI reviewed Mar 31, 2026

View reviewed changes

.github/workflows/release.yml Show resolved Hide resolved

RainbowMango force-pushed the pr_pin_all_action_sha branch 2 times, most recently from 9e99fd6 to ae2e932 Compare March 31, 2026 03:19

RainbowMango added this to the v1.18 milestone Mar 31, 2026

ci: pin remaining GitHub Actions to commit SHAs

42346bc

This hardens workflow supply-chain security and improves reproducibility. Signed-off-by: RainbowMango <qdurenhongcai@gmail.com>

RainbowMango force-pushed the pr_pin_all_action_sha branch from ae2e932 to 42346bc Compare March 31, 2026 04:10

RainbowMango requested a review from Copilot March 31, 2026 06:32

Copilot started reviewing on behalf of RainbowMango March 31, 2026 06:32 View session

Copilot AI reviewed Mar 31, 2026

View reviewed changes

zhzhuang-zju mentioned this pull request Mar 31, 2026

Track SHA pinning support for slsa-github-generator #7337

Open

1 task

karmada-bot assigned zhzhuang-zju Mar 31, 2026

karmada-bot added the lgtm Indicates that a PR is ready to be merged. label Mar 31, 2026

karmada-bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 31, 2026

karmada-bot merged commit da5b166 into karmada-io:master Mar 31, 2026
22 checks passed

This was referenced Mar 31, 2026

Compromised aquasecurity/trivy-action detected in GitHub Actions workflows #7314

Closed

fix: fixed the pinned dependencies issue #5396

Closed

	# Must be referenced by a tag. https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#referencing-the-slsa-generator
	# Pinned to the commit corresponding to tag v2.1.0 for security. See: https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#referencing-the-slsa-generator

Conversation

RainbowMango commented Mar 31, 2026

Uh oh!

gemini-code-assist bot commented Mar 31, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

zhzhuang-zju Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

zhzhuang-zju Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

RainbowMango Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

zhzhuang-zju Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

RainbowMango Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

zhzhuang-zju Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov-commenter commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

zhzhuang-zju commented Mar 31, 2026

Uh oh!

gemini-code-assist bot commented Mar 31, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

zhzhuang-zju commented Mar 31, 2026

Uh oh!

RainbowMango commented Mar 31, 2026

Uh oh!

zhzhuang-zju commented Mar 31, 2026

Uh oh!

karmada-bot commented Mar 31, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

codecov-commenter commented Mar 31, 2026 •

edited

Loading