Skip to content

Organization owned immutable actions raise warning about unpinned 3rd party actions tag #21076

@StephenHodgson

Description

@StephenHodgson

This CodeQL warning is great, but its language specifically says 3rd party actions, but my actions are getting warnings even when they're immutable and owned by my organization.

/**
* @name Unpinned tag for a non-immutable Action in workflow
* @description Using a tag for a non-immutable Action that is not pinned to a commit can lead to executing an untrusted Action through a supply chain attack.
* @kind problem
* @security-severity 5.0
* @problem.severity warning
* @precision medium
* @id actions/unpinned-tag
* @tags security
* actions
* external/cwe/cwe-829
*/

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions