GitHub Actions

Overiew

You can check the state of GitHub Action usage in the organization here.

We adhere to GitHub's official recommendations with the following specifications:

Version pinning rules

  • If an action is from a trusted publisher:
    • pin to a full commit SHA, or
    • to a release tag (e.g. v5) other than master and latest.
  • If an action is from an untrusted publisher:
    • pin to a full commit SHA.
  • Always prefer pinning to full commit SHAs.
  • Use the latest major version of actions whenever possible.

Trusted Publishers

  • BYM-IKT: Actions prefixed with bym-ikt/*
  • GitHub: Actions prefixed with actions/*
  • Docker: Actions prefixed with docker/*
  • AWS: Actions prefixed with aws-actions/*
  • HashiCorp: Actions prefixed with hashicorp/*
  • Slack: Actions prefixed with slackapi/*
  • Sonar: Actions prefixed with SonarSource/*
  • Datadog: Actions prefixed with DataDog/*
  • pnpm: Actions prefixed with pnpm/*

Warning

Any publisher not listed above is treated as untrusted.

Please contact Team Cloud if you want to update the list of trusted publishers.

Examples

Using actions from a Trusted Publisher

Bad

uses: actions/setup-node@master

or

uses: actions/setup-node@latest
Avoid pinning actions to a unpredictable ref/tag even if the action is from a trusted publisher.

Good

uses: actions/setup-node@v5

or

uses: actions/setup-node@0784f79ffb3c227b2637e172b69b14d2e3729525  # v5.2.0

actions/setup-node is from a trusted publisher, so pinning to a tag (like v5) is allowed. Pinning to a full commit SHA is still preferred. Even for trusted publishers, do not pin to master or latest, since these are more volatile.

Using actions from an Untrusted Publisher

Bad

uses: amogus/clean-vents@v4.2.0

Good

uses: amogus/clean-vents@0784f79ffb3c227b2637e172b69b14d2e3729525  # v4.2.0

amogus/* is not a trusted publisher, so it must not be pinned to a branch or a tag. Instead, pin it to a full commit SHA, and optionally add a comment next to it detailing which tag that SHA maps to.