Skip to content

[StepSecurity] ci: Harden GitHub Actions - #235

Merged
bjohansebas merged 2 commits into
expressjs:masterfrom
step-security-bot:chore/GHA-171514-stepsecurity-remediation
May 17, 2025
Merged

[StepSecurity] ci: Harden GitHub Actions#235
bjohansebas merged 2 commits into
expressjs:masterfrom
step-security-bot:chore/GHA-171514-stepsecurity-remediation

Conversation

@step-security-bot

@step-security-bot step-security-bot commented May 17, 2025

Copy link
Copy Markdown
Contributor

Summary

This pull request is created by StepSecurity at the request of @UlisesGascon. Please merge the Pull Request to incorporate the requested changes. Please tag @UlisesGascon on your message if you have any questions related to the PR.
Realted expressjs/security-wg#2

Security Fixes

Pinned Dependencies

GitHub Action tags and Docker tags are mutable. This poses a security risk. GitHub's Security Hardening guide recommends pinning actions to full length commit.

Feedback

For bug reports, feature requests, and general feedback; please email support@stepsecurity.io. To create such PRs, please visit https://app.stepsecurity.io/securerepo.

Signed-off-by: StepSecurity Bot bot@stepsecurity.io

@step-security-bot
[StepSecurity] ci: Harden GitHub Actions
3ad2ca6 
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
@UlisesGascon
UlisesGascon requested a review from bjohansebas May 17, 2025 15:14
@UlisesGascon UlisesGascon self-assigned this May 17, 2025
UlisesGascon
UlisesGascon approved these changes May 17, 2025
View reviewed changes

@UlisesGascon UlisesGascon left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@bjohansebas

bjohansebas commented May 17, 2025

Copy link
Copy Markdown
Member

I think the error is related to Supertest, so I'm going to pin the version in the CI

@bjohansebas
ping supertest in ci
5f473ff 
Signed-off-by: Sebastian Beltran <bjohansebas@gmail.com>
@bjohansebas
bjohansebas merged commit 5f13b14 into expressjs:master May 17, 2025
@UlisesGascon UlisesGascon mentioned this pull request May 17, 2025
Closed
3 tasks
@UlisesGascon UlisesGascon mentioned this pull request Jul 17, 2025
Merged
@nobodysfool nobodysfool mentioned this pull request Jul 18, 2025
Merged
@Zufallsgenerat0r Zufallsgenerat0r mentioned this pull request Jul 18, 2025
Merged
@n-dering n-dering mentioned this pull request Jul 19, 2025
Open
@raymondjxu raymondjxu mentioned this pull request Jul 20, 2025
Merged
mergify Bot added a commit to robfrank/linklift that referenced this pull request Aug 15, 2025
@mergify