Problem
The release and CI workflows reference third-party Actions by mutable version tags, e.g. softprops/action-gh-release@v2, vedantmgoyal9/winget-releaser@v2, actions/checkout@v6, actions/setup-dotnet@v5.
A git tag can be repointed. If one of those action repositories is compromised, an attacker can move the tag to malicious code, which then runs inside the release pipeline with publish credentials in scope (NUGET_API_KEY, WINGET_TOKEN, HOMEBREW_TAP_TOKEN).
Impact
Supply-chain compromise leading to arbitrary code execution in the release job and potential theft/misuse of publish secrets. vedantmgoyal9/winget-releaser is the highest concern as a community action holding a token.
Fix
- Pin every third-party action to a full-length commit SHA, with a trailing comment noting the version, e.g.
uses: softprops/action-gh-release@<sha> # v2.x.x.
- Enable Dependabot for the
github-actions ecosystem so SHAs are bumped with review.
Affected files
.github/workflows/release.yml, winget-releaser.yml, homebrew-releaser.yml, ci.yml, smoke-test.yml, validate-packaging.yml
Priority: High — this is the only gap with a realistic remote-attacker path.
Problem
The release and CI workflows reference third-party Actions by mutable version tags, e.g.
softprops/action-gh-release@v2,vedantmgoyal9/winget-releaser@v2,actions/checkout@v6,actions/setup-dotnet@v5.A git tag can be repointed. If one of those action repositories is compromised, an attacker can move the tag to malicious code, which then runs inside the release pipeline with publish credentials in scope (
NUGET_API_KEY,WINGET_TOKEN,HOMEBREW_TAP_TOKEN).Impact
Supply-chain compromise leading to arbitrary code execution in the release job and potential theft/misuse of publish secrets.
vedantmgoyal9/winget-releaseris the highest concern as a community action holding a token.Fix
uses: softprops/action-gh-release@<sha> # v2.x.x.github-actionsecosystem so SHAs are bumped with review.Affected files
.github/workflows/release.yml,winget-releaser.yml,homebrew-releaser.yml,ci.yml,smoke-test.yml,validate-packaging.ymlPriority: High — this is the only gap with a realistic remote-attacker path.