What the developer wrote
Authored by benma
ci: pin mattermost notify action
Pin the Mattermost action in report-artifacts to an immutable commit SHA instead of the mutable master branch.
Also set explicit job-level permissions to contents: read to reduce default GITHUB_TOKEN privileges for this secret-using job.
What changed, and why it matters
This commit hardens the project's automated CI workflow in two ways: it pins a third-party Mattermost notification action to a specific, unchangeable version (instead of a moving 'master' branch), and it restricts the job's GitHub token permissions to read-only access to repository contents. These are defensive security improvements that reduce supply-chain and privilege risks, but the commit itself does not fix an active vulnerability.
No immediate action required; this is a hardening change. Reviewers should verify the pinned SHA matches the claimed v2.0.0 release on the mattermost/action-mattermost-notify repository and consider applying the same pinning/least-privilege pattern to other workflows.
Security signals we found
Third-party GitHub Action pinned from floating branch to immutable commit SHA
Job-level GITHUB_TOKEN permissions reduced to contents: read
Job handles secrets (Mattermost webhook) and now runs with lower privileges
Evidence from the diff
In .github/workflows/ci-common.yml, the report-artifacts job now declares permissions: contents: read, limiting the default GITHUB_TOKEN from broader write scopes. It also replaces uses: mattermost/action-mattermost-notify@master with a pinned commit SHA (b7d118e440bf2749cd18a4a8c88e7092e696257a) identified as the v2.0.0 release. Pinning prevents silent updates if the action’s master branch is compromised or modified, and reduced permissions limit blast radius if the job or action is exploited.
Changed components
.github/workflows/ci-common.ymlreport-artifacts jobMattermost notification stepInspect captured patch +4 / −1
diff --git a/.github/workflows/ci-common.yml b/.github/workflows/ci-common.yml
index 9ddb59a..4114a7a 100644
--- a/.github/workflows/ci-common.yml
+++ b/.github/workflows/ci-common.yml
@@ -313,6 +313,8 @@ jobs:
needs: [build]
runs-on: ubuntu-22.04
if: github.event_name == 'push' && !cancelled()
+ permissions:
+ contents: read
steps:
- name: Clone the repo
uses: actions/checkout@v4
@@ -328,7 +330,8 @@ jobs:
echo EOF
} >> ${GITHUB_OUTPUT}
- name: Send message to mattermost
- uses: mattermost/action-mattermost-notify@master
+ # Hash corresponds to v2.0.0 tag. https://github.com/mattermost/action-mattermost-notify/releases/tag/2.0.0
+ uses: mattermost/action-mattermost-notify@b7d118e440bf2749cd18a4a8c88e7092e696257a
continue-on-error: true
if: job.status == 'success'
with:
Why this scored 30/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.