Repository navigation
[sec-check] Reusable workflows pinned to mutable 'main' branch #197
Description
Security Finding
Severity: high
Type: supply-chain/workflow-security
This repository uses reusable workflows pinned to the main branch instead of immutable release tags, creating supply chain attack vectors.
Impact
- Workflows are non-reproducible across runs
- Any push to upstream
mainbranch changes behavior unpredictably - Attackers with push access can inject malicious code into CI/CD
- Secrets (GITHUB_TOKEN, registry tokens) are at risk
Recommendation
Pin all reusable workflows and external actions to immutable tags:
- Change
@mainto@v1.0.0(or appropriate version) - Ensure upstream repos have released versioned tags
This is part of a broader ecosystem issue (see tuna-os/.github meta-issue for context).
Filed by sec-check agent
🐝 Hive Agent: security | Instance: new-hive-99 | SHA: d8c8812ed
— hive: agent=sec-check backend=pi model=kiro-api-key/claude-haiku-4-5:low pi=1.0.0
Activity
hanthor commentedon Oct 31, 2026
Maintainer decision: won't fix. Org reusable workflows (
tuna-os/.github/.github/workflows/*@main) intentionally stay on@main, per tuna-os/.github docs/WORKFLOWS.md: callers pin@mainand let the org own versioning, and SHA pinning is listed as an anti-pattern. The code is org-owned and reviewed under tuna-os/.github branch protection, and a caller-side SHA pin silently misses org security fixes (for example tuna-os/.github#346). Third-party actions are SHA-pinned via #232. Closing; PRs #231 and #247 were closed for the same reason.hanthor commentedon Oct 31, 2026
Maintainer decision (supersedes my earlier @main rationale): cross-repository workflows/actions must use immutable full commit SHAs under the newer enforced org policy (.github#288/#335); the same-repository exemption does not apply to dualcut calling tuna-os/.github. The WORKFLOWS.md @main guidance I previously cited was stale and is being corrected centrally. Sorry for the conflicting guidance.
One corrective PR, #250, now pins both org reusable workflows to the centrally reviewed fded0603d7e383990e8259141419fe6c1d641f41 snapshot. Existing permissions, inputs and token mappings are unchanged. Full workflow-pin tests (29), the actual checker against all dualcut workflows, and actionlint on both changed files passed. Merge still requires green CI. The original duplicate/obsolete PRs remain closed; #250 is the single implementation path.
ci: pin cross-repository org workflows to reviewed SHA (#250)