Pin GitHub Actions to commit SHAs across Node packages

XMLWordPrintableJSON

    • Type: Task
    • Resolution: Unresolved
    • Priority: Unknown
    • None
    • Affects Version/s: None
    • Component/s: None
    • 0
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Use Case

      As a maintainer of the Node packages, I want our workflows pinned to immutable commit SHAs, so that a repointed upstream tag cannot silently change what runs in CI or in a release job.

      User Experience

      • n/a, CI and release infrastructure only

      Dependencies

      • GODRIVER-3790 tracks the same problem inside mongodb-labs/drivers-github-tools. Until that lands, our pinning is partial by construction: our release workflow calls mongodb-labs/drivers-github-tools/node/setup@v3, and that composite action runs actions/setup-node@v4 internally, inside our job.
      • GODRIVER-3780 (closed) and PYTHON-5353 (closed) are completed equivalents in sibling drivers. GODRIVER-3780 is the better template, and its review thread shows which references were missed on the first pass: github/codeql-action and mongodb-labs/drivers-github-tools.

      Risks/Unknowns

      • Dependabot has to be configured to bump pinned SHAs. Without that the pins go stale and we trade a supply-chain risk for an unpatched-action risk. Confirm the config handles SHA refs before pinning anything.
      • The Semgrep rule github-actions-mutable-action-tag only comments on lines a PR touches, so unpinned references in untouched files stay silent. Repo-wide completeness has to be checked by hand or by a linter, not inferred from a clean PR.
      • Consider adding zizmor, which mongodb-labs/drivers-github-tools already runs against its own workflows, so this class of issue is caught before Semgrep files it.
      • No VULN ticket exists for these repos yet. The scanner files them per repo, so this is proactive rather than a response to a finding.

      Acceptance Criteria

      Implementation Requirements

      • In each repo, pin every uses: reference to a full 40-character commit SHA, with the version kept as a trailing comment, for example uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v6
      • Cover all workflows, including release, CodeQL and any reusable or composite actions defined in the repo
      • Confirm dependabot is configured to update pinned SHAs in each repo

      Testing Requirements

      • All workflows pass in each repo after pinning
      • No github-actions-mutable-action-tag findings on subsequent PRs

      Follow Up Requirements

      • Re-check the drivers-github-tools references once GODRIVER-3790 is resolved, since those cannot be fully pinned from our side today

        1.
        		 Pin GitHub Actions to commit SHAs in node-mongodb-native NODE-7721 Sub-task Ready for Work Unassigned  
        2.
        		 Pin GitHub Actions to commit SHAs in js-bson NODE-7722 Sub-task Ready for Work Unassigned  
        3.
        		 Pin GitHub Actions to commit SHAs in mongodb-client-encryption NODE-7723 Sub-task Ready for Work Unassigned  
        4.
        		 Pin GitHub Actions to commit SHAs in mongodb-connection-string-url NODE-7724 Sub-task Ready for Work Unassigned  
        5.
        		 Pin GitHub Actions to commit SHAs in zstd NODE-7725 Sub-task Ready for Work Unassigned  
        6.
        		 Pin GitHub Actions to commit SHAs in kerberos NODE-7726 Sub-task Ready for Work Unassigned  

            Assignee:
            Sergey Zelenov
            Reporter:
            Sergey Zelenov
            None
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated: