Conversation
Replaces mutable tag/branch references with immutable SHA hashes to prevent supply chain attacks (ref: TeamPCP/Trivy March 2026). Actions left as tags: 0
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
The PR successfully implements security hardening by replacing mutable tags with commit SHAs across integration workflows. Codacy analysis indicates that the changes are up to standards. However, the review identified a recurring discrepancy between the pinned SHAs and their descriptive version comments. In multiple instances, the SHA corresponds to a v3.x release while the comment labels it as v2.x. These inconsistencies should be corrected before merging to ensure documentation accuracy and maintainability.
About this PR
- There is a systemic inconsistency where the commit SHAs point to newer versions (v3.x) of the GitHub Actions, but the trailing comments describe them as older versions (v2.x). This documentation gap violates the acceptance criteria for maintaining clear developer references.
Test suggestions
- Verify that 'actions/github-script' is pinned to SHA 6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45
- Verify that 'atlassian/gajira-login' is pinned to SHA 90a599561baaf8c05b080645ed73db7391c246ed
- Verify that 'atlassian/gajira-create' is pinned to SHA c0a9c69ac9d6aa063fed57201e55336ada860183
- Verify that 'atlassian/gajira-comment' is pinned to SHA 8ec356b5df49f1325653db7ee2da2b59a1d78203
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify that 'actions/github-script' is pinned to SHA 6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45
2. Verify that 'atlassian/gajira-login' is pinned to SHA 90a599561baaf8c05b080645ed73db7391c246ed
3. Verify that 'atlassian/gajira-create' is pinned to SHA c0a9c69ac9d6aa063fed57201e55336ada860183
4. Verify that 'atlassian/gajira-comment' is pinned to SHA 8ec356b5df49f1325653db7ee2da2b59a1d78203
🗒️ Improve review quality by adding custom instructions
| if: env.JIRA_CREATE_ISSUE_AUTO == 'true' | ||
| id: create_jira_issue | ||
| uses: atlassian/gajira-create@v2.0.1 | ||
| uses: atlassian/gajira-create@c0a9c69ac9d6aa063fed57201e55336ada860183 # v2.0.1 |
There was a problem hiding this comment.
🟡 MEDIUM RISK
Suggestion: The SHA points to v3.0.1. Update the comment to reflect the pinned version.
| uses: atlassian/gajira-create@c0a9c69ac9d6aa063fed57201e55336ada860183 # v2.0.1 | |
| uses: atlassian/gajira-create@c0a9c69ac9d6aa063fed57201e55336ada860183 # v3.0.1 |
| if: env.JIRA_CREATE_COMMENT_AUTO == 'true' && env.GITHUB_ISSUE_TYPE == 'issue' && env.GITHUB_ISSUE_HAS_JIRA_ISSUE_LABEL == 'true' | ||
| id: add_comment_jira_issue | ||
| uses: atlassian/gajira-comment@v2.0.2 | ||
| uses: atlassian/gajira-comment@8ec356b5df49f1325653db7ee2da2b59a1d78203 # v2.0.2 |
There was a problem hiding this comment.
🟡 MEDIUM RISK
Suggestion: The SHA points to v3.0.1. Update the version comment accordingly.
| uses: atlassian/gajira-comment@8ec356b5df49f1325653db7ee2da2b59a1d78203 # v2.0.2 | |
| uses: atlassian/gajira-comment@8ec356b5df49f1325653db7ee2da2b59a1d78203 # v3.0.1 |
| if: env.JIRA_CREATE_COMMENT_AUTO == 'true' && env.GITHUB_ISSUE_TYPE == 'issue' && env.GITHUB_ISSUE_HAS_JIRA_ISSUE_LABEL == 'true' | ||
| id: login | ||
| uses: atlassian/gajira-login@v2.0.0 | ||
| uses: atlassian/gajira-login@90a599561baaf8c05b080645ed73db7391c246ed # v2.0.0 |
There was a problem hiding this comment.
🟡 MEDIUM RISK
Suggestion: The SHA points to v3.0.0. Update the comment to match the version.
| uses: atlassian/gajira-login@90a599561baaf8c05b080645ed73db7391c246ed # v2.0.0 | |
| uses: atlassian/gajira-login@90a599561baaf8c05b080645ed73db7391c246ed # v3.0.0 |
| if: env.JIRA_CREATE_COMMENT_AUTO == 'true' | ||
| id: github_issue_type | ||
| uses: actions/github-script@v2.0.0 | ||
| uses: actions/github-script@6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 # v2.0.0 |
There was a problem hiding this comment.
🟡 MEDIUM RISK
Suggestion: The SHA points to v3.1.0, not v2.0.0. Update the comment to reflect the actual version being pinned.
| uses: actions/github-script@6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 # v2.0.0 | |
| uses: actions/github-script@6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45 # v3.1.0 |
1 participant
Pins all GitHub Actions from mutable tags/branches to immutable SHA hashes.
This prevents supply chain attacks like the TeamPCP/Trivy incident (March 2026), where attackers force-pushed tags to point at malicious commits.
Auto-generated by the Codacy security audit script.