From e227377390319b086d0a0ef59d8aa8354ddb56df Mon Sep 17 00:00:00 2001 From: codeopsai-bot Date: Sun, 21 Jun 2026 20:18:36 +0530 Subject: [PATCH 1/3] Pin third-party actions to commit SHAs This PR addresses 17 workflow findings: - [low] unpinned-action in .github/workflows/lint.yml: Unpinned action version: actions/checkout@v4 - [low] unpinned-action in .github/workflows/lint.yml: Unpinned action version: actions/setup-go@v5 - [medium] unpinned-action in .github/workflows/lint.yml: Unpinned action version: golangci/golangci-lint-action@v7 - [low] unpinned-action in .github/workflows/release.yml: Unpinned action version: actions/checkout@v4 - [medium] unpinned-action in .github/workflows/release.yml: Unpinned action version: docker/metadata-action@v3 - [medium] unpinned-action in .github/workflows/release.yml: Unpinned action version: docker/setup-qemu-action@v1 - [medium] unpinned-action in .github/workflows/release.yml: Unpinned action version: docker/setup-buildx-action@v1 - [medium] unpinned-action in .github/workflows/release.yml: Unpinned action version: docker/login-action@v1 - [medium] unpinned-action in .github/workflows/release.yml: Unpinned action version: docker/login-action@v1 - [medium] unpinned-action in .github/workflows/release.yml: Unpinned action version: docker/build-push-action@v2 - [medium] unpinned-action in .github/workflows/release.yml: Unpinned action version: peter-evans/dockerhub-description@v3 - [low] unpinned-action in .github/workflows/release.yml: Unpinned action version: actions/setup-go@v5 - [low] unpinned-action in .github/workflows/test.yml: Unpinned action version: actions/checkout@v2 - [low] unpinned-action in .github/workflows/test.yml: Unpinned action version: actions/setup-go@v5 - [low] unpinned-action in .github/workflows/test.yml: Unpinned action version: actions/upload-artifact@v4 - [low] unpinned-action in .github/workflows/test.yml: Unpinned action version: actions/checkout@v2 - [medium] unpinned-action in .github/workflows/test.yml: Unpinned action version: fgrosse/go-coverage-report@v1.1.1 These workflows handle CI/CD with elevated privileges; the affected configurations expand attack surface or grant tokens broader access than needed. See the PR description for per-finding rationale and citations. --- .github/workflows/lint.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 6c6a549c..0addf690 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -15,13 +15,13 @@ jobs: lint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 - name: Setup Go 1.24 - uses: actions/setup-go@v5 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff with: go-version: 1.24 - name: Lint - uses: golangci/golangci-lint-action@v7 + uses: golangci/golangci-lint-action@9fae48acfc02a90574d7c304a1758ef9895495fa with: only-new-issues: true version: v2.1.5 From c28f914cf830410e6bf6f1a3972be2b0e7692951 Mon Sep 17 00:00:00 2001 From: codeopsai-bot Date: Sun, 21 Jun 2026 20:18:37 +0530 Subject: [PATCH 2/3] Pin third-party actions to commit SHAs This PR addresses 17 workflow findings: - [low] unpinned-action in .github/workflows/lint.yml: Unpinned action version: actions/checkout@v4 - [low] unpinned-action in .github/workflows/lint.yml: Unpinned action version: actions/setup-go@v5 - [medium] unpinned-action in .github/workflows/lint.yml: Unpinned action version: golangci/golangci-lint-action@v7 - [low] unpinned-action in .github/workflows/release.yml: Unpinned action version: actions/checkout@v4 - [medium] unpinned-action in .github/workflows/release.yml: Unpinned action version: docker/metadata-action@v3 - [medium] unpinned-action in .github/workflows/release.yml: Unpinned action version: docker/setup-qemu-action@v1 - [medium] unpinned-action in .github/workflows/release.yml: Unpinned action version: docker/setup-buildx-action@v1 - [medium] unpinned-action in .github/workflows/release.yml: Unpinned action version: docker/login-action@v1 - [medium] unpinned-action in .github/workflows/release.yml: Unpinned action version: docker/login-action@v1 - [medium] unpinned-action in .github/workflows/release.yml: Unpinned action version: docker/build-push-action@v2 - [medium] unpinned-action in .github/workflows/release.yml: Unpinned action version: peter-evans/dockerhub-description@v3 - [low] unpinned-action in .github/workflows/release.yml: Unpinned action version: actions/setup-go@v5 - [low] unpinned-action in .github/workflows/test.yml: Unpinned action version: actions/checkout@v2 - [low] unpinned-action in .github/workflows/test.yml: Unpinned action version: actions/setup-go@v5 - [low] unpinned-action in .github/workflows/test.yml: Unpinned action version: actions/upload-artifact@v4 - [low] unpinned-action in .github/workflows/test.yml: Unpinned action version: actions/checkout@v2 - [medium] unpinned-action in .github/workflows/test.yml: Unpinned action version: fgrosse/go-coverage-report@v1.1.1 These workflows handle CI/CD with elevated privileges; the affected configurations expand attack surface or grant tokens broader access than needed. See the PR description for per-finding rationale and citations. --- .github/workflows/release.yml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index be987501..fae2be7b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -17,10 +17,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 - name: Docker meta id: meta - uses: docker/metadata-action@v3 + uses: docker/metadata-action@b2391d37b4157fa4aa2e118d643f417910ff3242 with: # list of Docker images to use as base name for tags images: | @@ -35,24 +35,24 @@ jobs: type=semver,pattern={{major}} type=sha - name: Set up QEMU - uses: docker/setup-qemu-action@v1 + uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v1 + uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 - name: Login to DockerHub - uses: docker/login-action@v1 + uses: docker/login-action@dd4fa0671be5250ee6f50aedf4cb05514abda2c7 if: github.event.ref_type == 'tag' || github.event_name == 'workflow_dispatch' with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Login to GitHub Container Registry - uses: docker/login-action@v1 + uses: docker/login-action@dd4fa0671be5250ee6f50aedf4cb05514abda2c7 if: github.event.ref_type == 'tag' || github.event_name == 'workflow_dispatch' with: registry: ghcr.io username: ${{ github.repository_owner }} password: ${{ secrets.GITHUB_TOKEN }} - name: Build and push - uses: docker/build-push-action@v2 + uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a with: context: . platforms: ${{ github.event.ref_type == 'tag' && 'linux/amd64,linux/arm64' || 'linux/amd64' }} @@ -61,7 +61,7 @@ jobs: labels: ${{ steps.meta.outputs.labels }} - name: Docker Hub Description if: github.event.ref_type == 'tag' || github.event_name == 'workflow_dispatch' - uses: peter-evans/dockerhub-description@v3 + uses: peter-evans/dockerhub-description@dc67fad7001ef9e8e3c124cb7a64e16d0a63d864 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} @@ -69,7 +69,7 @@ jobs: readme-filepath: ./README.md short-description: "Cloudflare Operator Controller Manager" - name: Setup Go 1.24 - uses: actions/setup-go@v5 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff if: github.event.ref_type == 'tag' with: go-version: 1.24 From f5a9385ff23c623759cde5cea8675f543dfd08fe Mon Sep 17 00:00:00 2001 From: codeopsai-bot Date: Sun, 21 Jun 2026 20:18:39 +0530 Subject: [PATCH 3/3] Pin third-party actions to commit SHAs This PR addresses 17 workflow findings: - [low] unpinned-action in .github/workflows/lint.yml: Unpinned action version: actions/checkout@v4 - [low] unpinned-action in .github/workflows/lint.yml: Unpinned action version: actions/setup-go@v5 - [medium] unpinned-action in .github/workflows/lint.yml: Unpinned action version: golangci/golangci-lint-action@v7 - [low] unpinned-action in .github/workflows/release.yml: Unpinned action version: actions/checkout@v4 - [medium] unpinned-action in .github/workflows/release.yml: Unpinned action version: docker/metadata-action@v3 - [medium] unpinned-action in .github/workflows/release.yml: Unpinned action version: docker/setup-qemu-action@v1 - [medium] unpinned-action in .github/workflows/release.yml: Unpinned action version: docker/setup-buildx-action@v1 - [medium] unpinned-action in .github/workflows/release.yml: Unpinned action version: docker/login-action@v1 - [medium] unpinned-action in .github/workflows/release.yml: Unpinned action version: docker/login-action@v1 - [medium] unpinned-action in .github/workflows/release.yml: Unpinned action version: docker/build-push-action@v2 - [medium] unpinned-action in .github/workflows/release.yml: Unpinned action version: peter-evans/dockerhub-description@v3 - [low] unpinned-action in .github/workflows/release.yml: Unpinned action version: actions/setup-go@v5 - [low] unpinned-action in .github/workflows/test.yml: Unpinned action version: actions/checkout@v2 - [low] unpinned-action in .github/workflows/test.yml: Unpinned action version: actions/setup-go@v5 - [low] unpinned-action in .github/workflows/test.yml: Unpinned action version: actions/upload-artifact@v4 - [low] unpinned-action in .github/workflows/test.yml: Unpinned action version: actions/checkout@v2 - [medium] unpinned-action in .github/workflows/test.yml: Unpinned action version: fgrosse/go-coverage-report@v1.1.1 These workflows handle CI/CD with elevated privileges; the affected configurations expand attack surface or grant tokens broader access than needed. See the PR description for per-finding rationale and citations. --- .github/workflows/test.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 3841e301..73c420a4 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -11,15 +11,15 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 - name: Setup Go 1.24 - uses: actions/setup-go@v5 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff with: go-version: 1.24 - name: Test run: make test - name: Archive code coverage results - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 with: name: code-coverage path: cover.out @@ -33,8 +33,8 @@ jobs: actions: read pull-requests: write steps: - - uses: actions/checkout@v2 - - uses: fgrosse/go-coverage-report@v1.1.1 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 + - uses: fgrosse/go-coverage-report@ba3f798d6f32b9b16faea37cc7192261bb25b192 with: coverage-artifact-name: "code-coverage" coverage-file-name: "cover.out"