Please make Dependabot Alerts support SHA-hash-versioned GitHub Actions

[ronjouch]

Select Topic Area

Bug

Body

Dependabot does two things regarding vulnerable dependencies:

1. Dependabot Alerts
2. Dependabot PRs

However, when using SHA-hash-versioned GHAs, Dependabot is limited to PRs only (dependabot/dependabot-core#4691 , dependabot/dependabot-core#7376 , dependabot/dependabot-core#2835) and Alerts do not work 😕.

This is acknowledged in GH Docs / Dependabot alerts, section “Detection of insecure dependencies”:

“Dependabot will only create Dependabot alerts for vulnerable GitHub Actions that use semantic versioning. You will not receive alerts for a vulnerable action that uses SHA versioning. If you use GitHub Actions with SHA versioning, we recommend enabling Dependabot version updates for your repository or organization to keep the actions you use updated to the latest versions.”

This is a security-unfortunate product asymmetry / limitation. It is an extra hurdle in the way of generalizing sha-pinning to avoid supply chain vulns like tj-actions/changed-files action is compromised, and means users relying on Alerts to keep track of Dependabot vulns will be left in the dark, causing missing out on security issues 🙁.

→ Please make Dependabot Alerts support SHA-hash-versioned GHAs.

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[juhoinkinen]

Now when there is the (very useful!) option to enforce SHA-pinning, even organization or enterprise widely, it would be even more important to be able to receive alerts for SHA-pinned Actions too.

Is enabling this on the roadmap?

[jayaddison]

A naive solution might be to create an index of hashes-to-semantic-versions on a per-action basis, and then to cross-reference against that index for any actions pinned within each workflow file.

An alternative could be to allow workflow authors to continue to specify action versions using semantic versions (e.g. v5) -- but for a separate, newly-introduced YAML key to contain the expected commit hash that the version should be retrieved from. The workflow should fail if there is a mismatch between the two when the action is retrieved for use.

The benefit of the latter approach would be that Dependabot Alerts could begin/remain functioning for all existing workflow files that use semantic versions -- and people who are security-conscious could add pinned action versions, as they sometimes do already.

[jayaddison]

To provide an example of the second approach mentioned: instead of:

    steps: 
      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0

I would anticipate something like:

    steps: 
      - uses: actions/checkout@v6
        integrity: sha1-1af3b93b6815bc44a9784bd300feb67ff0d1eeb3

This says: use the v6-tagged version of actions/checkout -- allowing Dependabot Alerts to find it if, for example, a CVE that affects >=5.0.0,<7.0.0 is found -- but fail if the SHA1 integrity of the commit differs from 1af3b93b6815bc44a9784bd300feb67ff0d1eeb3, because if so the tag has unexpectedly changed.