sha pin all github actions for package workflow
What the developer wrote
Authored by Craig Raw
sha pin all github actions for package workflow
What changed, and why it matters
This commit changes the project's automated build workflow to lock down the exact versions of external GitHub Actions it uses by specifying their cryptographic SHA fingerprints instead of version tags. This is a defensive hardening measure that reduces the risk of a supply-chain attack, where a malicious or compromised update to a third-party action could tamper with the wallet's build artifacts or signing certificates.
No immediate incident response is required. Reviewers should verify the pinned SHAs match the claimed release tags on the official action repositories, ensure the project has a documented process for updating pinned action versions, and consider applying the same pinning discipline to other workflows in the repository.
Security signals we found
Supply-chain hardening via SHA pinning of third-party GitHub Actions
Protection against tag-retargeting and compromised action updates
Applies to actions handling source checkout, Java setup, macOS code signing/notarization, and artifact upload
No active vulnerability or exploit code present in the diff
Evidence from the diff
The package.yaml workflow previously referenced GitHub Actions by floating version tags (e.g., actions/checkout@v6, actions/setup-java@v5, sparrowwallet/github-actions/codesign-macos@v1, actions/upload-artifact@v6). The commit pins these to immutable commit SHAs corresponding to specific releases. Pinning prevents the workflow from silently picking up a newer, potentially compromised version of an action if a tag is retargeted or a supply-chain incident occurs. It does not by itself fix an active vulnerability; it is a preventive security control.
Changed components
.github/workflows/package.yamlactions/checkoutactions/setup-javasparrowwallet/github-actions/codesign-macosactions/upload-artifactInspect captured patch +5 / −5
diff --git a/.github/workflows/package.yaml b/.github/workflows/package.yaml
index 8fe22c0..43c72e3 100644
--- a/.github/workflows/package.yaml
+++ b/.github/workflows/package.yaml
@@ -12,14 +12,14 @@ jobs:
matrix:
os: [windows-2022, ubuntu-22.04, ubuntu-22.04-arm, macos-15-intel, macos-14]
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
submodules: recursive
- name: Clear Java tool-cache for reproducibility
shell: bash
run: rm -rf "$RUNNER_TOOL_CACHE"/Java_*
- name: Set up JDK 25.0.2
- uses: actions/setup-java@v5
+ uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
with:
distribution: 'temurin'
java-version: '25.0.2'
@@ -29,7 +29,7 @@ jobs:
run: ./gradlew jpackage
- name: Codesign, package and notarize macOS distribution
if: ${{ runner.os == 'macOS' }}
- uses: sparrowwallet/github-actions/codesign-macos@v1
+ uses: sparrowwallet/github-actions/codesign-macos@6eeb7bf9b882cf89ff96b77f99bcf487b9d33992 # v1
with:
app-name: Sparrow
certificate: ${{ secrets.MACOS_CERTIFICATE }}
@@ -47,7 +47,7 @@ jobs:
if: ${{ runner.os == 'Linux' }}
run: ./repackage.sh
- name: Upload Artifact
- uses: actions/upload-artifact@v6
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: Sparrow Build - ${{ runner.os }} ${{ runner.arch }}
path: |
@@ -65,7 +65,7 @@ jobs:
run: ./repackage.sh
- name: Upload Headless Artifact
if: ${{ runner.os == 'Linux' }}
- uses: actions/upload-artifact@v6
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: Sparrow Build - ${{ runner.os }} ${{ runner.arch }} Headless
path: |
Why this scored 37/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.