GitHub Actions - security updates (#7138)

ewels · web-flow · commit 5e2ef57621e5 · 2026-05-13T08:20:13.000-05:00
* Update GitHub actions and pin shas Signed-off-by: Phil Ewels <phil.ewels@seqera.io> * Don't persist credentials, avoid template-injection See https://docs.zizmor.sh/audits/\#template-injection Signed-off-by: Phil Ewels <phil.ewels@seqera.io> * Add least-privilege permissions blocks, fix template-injection in git config - Add explicit permissions blocks (workflow + job level, contents: read where possible) to build, cffconvert, docs, stale - stale job gets issues: write + pull-requests: write (only what actions/stale actually needs) - Move github.event.pusher.name/email out of the git config run script and into env vars to prevent shell injection via a malicious pusher Signed-off-by: Phil Ewels <phil.ewels@seqera.io> * Revert: leave credentials for build + publish, where they're needed Signed-off-by: Phil Ewels <phil.ewels@seqera.io> --------- Signed-off-by: Phil Ewels <phil.ewels@seqera.io>
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -17,10 +17,15 @@ on:
     types: [opened, reopened, synchronize]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     timeout-minutes: 100
     strategy:
       fail-fast: false
@@ -29,10 +34,11 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
           submodules: true
+          persist-credentials: false
 
       - name: Get the commit message
         id: get_commit_message
@@ -62,7 +68,7 @@ jobs:
           NXF_GITHUB_ACCESS_TOKEN: ${{ secrets.NXF_GITHUB_ACCESS_TOKEN }}
 
       - name: Setup Java ${{ matrix.java_version }}
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           java-version: ${{matrix.java_version}}
           distribution: 'temurin'
@@ -99,7 +105,7 @@ jobs:
 
       - name: Publish tests report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: report-unit-tests-jdk-${{ matrix.java_version }}
           path: |
@@ -112,6 +118,8 @@ jobs:
     if: ${{ !contains(needs.build.outputs.commit_message, '[ci fast]') }}
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     timeout-minutes: 90
     strategy:
       fail-fast: false
@@ -120,10 +128,11 @@ jobs:
         test_mode: ["test_integration", "test_parser_v2", "test_docs", "test_aws", "test_azure", "test_google", "test_wave"]
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
           submodules: true
+          persist-credentials: false
 
       - name: Setup env
         run: |
@@ -134,7 +143,7 @@ jobs:
           NXF_GITHUB_ACCESS_TOKEN: ${{ secrets.NXF_GITHUB_ACCESS_TOKEN }}
 
       - name: Setup Java ${{ matrix.java_version }}
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           java-version: ${{matrix.java_version}}
           distribution: 'temurin'
@@ -177,7 +186,7 @@ jobs:
             tar -cvf validation-tests.tar.gz validation
 
       - name: Publish tests report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: report-${{ matrix.test_mode }}-jdk-${{ matrix.java_version }}
@@ -195,13 +204,14 @@ jobs:
           contents: write # Allow writing to repository contents
       steps:
           - name: Checkout
-            uses: actions/checkout@v4
+            uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
             with:
                 fetch-depth: 1
                 submodules: true
+                persist-credentials: false
                 
           - name: Setup Java 17
-            uses: actions/setup-java@v4
+            uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
             with:
                 java-version: 17
                 distribution: 'temurin'
@@ -213,10 +223,12 @@ jobs:
                 wget -q -O wave https://github.com/seqeralabs/wave-cli/releases/download/v1.4.1/wave-1.4.1-linux-x86_64
                 chmod +x wave
                 mv wave /usr/local/bin/
-                echo "COMMIT_MESSAGE=\"${{ needs.build.outputs.commit_message }}\"" >> $GITHUB_ENV
+                echo "COMMIT_MESSAGE=\"${NEEDS_BUILD_OUTPUTS_COMMIT_MESSAGE}\"" >> $GITHUB_ENV
+            env:
+              NEEDS_BUILD_OUTPUTS_COMMIT_MESSAGE: ${{ needs.build.outputs.commit_message }}
 
           - name : Docker Login to Seqera public CR
-            uses : docker/login-action@v3
+            uses : docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
             with :
                 registry : "public.cr.seqera.io"
                 username : "public-cr-admin"
@@ -242,33 +254,40 @@ jobs:
       pull-requests: write
       issues: write
     steps:
+      # Intentionally persists credentials: the `release` task in
+      # packing.gradle runs `git push` and `git push origin vX.Y.Z` against
+      # this repo; both rely on actions/checkout having written the token
+      # into .git/config as http.extraheader.
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # zizmor: ignore[artipacked]
         with:
           fetch-depth: 0
           submodules: true
 
       - name: Setup Java 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           java-version: 17
           distribution: 'temurin'
           architecture: x64
           cache: gradle
 
       - name: Configure Git
+        env:
+          GIT_USER_NAME: ${{ github.event.pusher.name || github.actor }}
+          GIT_USER_EMAIL: ${{ github.event.pusher.email || format('{0}@users.noreply.github.com', github.actor) }}
         run: |
-          git config --global user.name "${{ github.event.pusher.name || github.actor }}"
-          git config --global user.email "${{ github.event.pusher.email || format('{0}@users.noreply.github.com', github.actor) }}"
+          git config --global user.name "$GIT_USER_NAME"
+          git config --global user.email "$GIT_USER_EMAIL"
 
       - name: Docker Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Docker Login to Seqera public CR
-        uses: docker/login-action@v3
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           registry: "public.cr.seqera.io"
           username: ${{ vars.SEQERA_PUBLIC_CR_USERNAME }}
diff --git a/.github/workflows/cffconvert.yml b/.github/workflows/cffconvert.yml
@@ -5,15 +5,22 @@ on:
     paths:
       - CITATION.cff
 
+permissions:
+  contents: read
+
 jobs:
   validate:
     name: "validate"
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Check out a copy of the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Check whether the citation metadata from CITATION.cff is valid
-        uses: citation-file-format/cffconvert-github-action@2.0.0
+        uses: citation-file-format/cffconvert-github-action@4cf11baa70a673bfdf9dad0acc7ee33b3f4b6084 # 2.0.0
         with:
           args: "--validate"
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
@@ -25,12 +25,13 @@ jobs:
       id-token: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Run Claude PR Action
-        uses: anthropics/claude-code-action@beta
+        uses: anthropics/claude-code-action@f4fb5c6cdccc1ee7af63692f5d08d56efaa64cc8 # v1.0.121
         with:
           anthropic_api_key: ${{ secrets.NEXTFLOW_ANTHROPIC_API_KEY }}
           timeout_minutes: "60"
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
@@ -5,13 +5,21 @@ on:
     paths:
       - 'docs/**'
   workflow_dispatch:
+
+permissions:
+  contents: read
+
 jobs:
   docs-build:
     name: Build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.9.25'
 
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
@@ -4,11 +4,17 @@ on:
     - cron: '30 1 * * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   stale:
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
         with:
           days-before-stale: 180
           days-before-close: -1
