From daf77e0d70db5cdc0a28a045c5ea1db68708cb43 Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Tue, 22 Sep 2026 09:02:10 +0000 Subject: [PATCH] Pin every third-party action to a commit SHA Found while auditing all 26 unslothai repositories against the 2026-09-21 cargo-miri cache disclosure. This is not an instance of that class: the two jobs here that write caches hold no secrets at all, so the chain never starts. It is the adjacent supply-chain problem the same audit looks for. 52 uses across 20 distinct actions referenced a mutable tag. A tag is a pointer the upstream owner can move at any time, so every one of them was an agreement to run whatever that repository contains on the day CI happens to run, decided by someone outside this project. Two matter more than the rest: ilammy/msvc-dev-cmd@v1 and anzz1/action-create-release@v1 are major-version tags on small single-maintainer repositories, and the second runs in the release job, which holds secrets.GITHUB_TOKEN. That token is ephemeral and expires with the job, which bounds the damage but does not remove it. Each ref is now a 40-character commit SHA with the tag it resolved to kept in a trailing comment, so the version stays readable and renovate-style tooling can still see it. No version changes: every SHA is what the tag pointed at when this was written, so the behaviour is identical to the last run. One incidental finding, recorded because it looks alarming and is not. build.yml used two spellings, prompt/actions-commit-hash in seven places and pr-mpt/actions-commit-hash in one, which reads like a typosquat. They are the same repository: pr-mpt was renamed to prompt, GitHub redirects the old path, and both resolve to 01d19a83c242e1851c9aa6cf9625092ecd095d09. Pinning collapses them onto one identity, so the question cannot come up again. These files are inherited from upstream leejet/stable-diffusion.cpp, so the diff is deliberately nothing but the refs. Not addressed here, so it is not lost: the ROCm cache at build.yml:476 stores C:\TheRock\build, which is a Python virtual environment the later build activates and executes, under the key rocm-wheels--. That key records no content identity, and there is no lockfile in the repository to hash because the wheels come from an index at install time. The exposure is cache poisoning rather than secret disclosure, and it is bounded by cache writes being scoped to the branch that made them, so a pull request cannot reach the entry master uses. Fixing it properly means splitting the combined action into a restore and a gated save in inherited upstream code, which is a larger change than this one should carry. --- .github/workflows/build.yml | 100 ++++++++++---------- .github/workflows/close-inactive-issues.yml | 2 +- .github/workflows/stale-prs.yml | 2 +- 3 files changed, 52 insertions(+), 52 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index f1a712f06..06485ca16 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -60,17 +60,17 @@ jobs: steps: - name: Clone id: checkout - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3 with: submodules: recursive - name: Setup Node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 20 - name: Setup pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 with: version: 10.15.1 @@ -91,7 +91,7 @@ jobs: - name: Get commit hash id: commit if: ${{ ( github.event_name == 'push' && github.ref == 'refs/heads/master' ) || github.event.inputs.create_release == 'true' }} - uses: prompt/actions-commit-hash@v2 + uses: prompt/actions-commit-hash@01d19a83c242e1851c9aa6cf9625092ecd095d09 # v2 - name: Fetch system info id: system-info @@ -111,7 +111,7 @@ jobs: - name: Upload artifacts if: ${{ ( github.event_name == 'push' && github.ref == 'refs/heads/master' ) || github.event.inputs.create_release == 'true' }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: sd-${{ env.BRANCH_NAME }}-${{ steps.commit.outputs.short }}-bin-${{ steps.system-info.outputs.OS_TYPE }}-${{ steps.system-info.outputs.OS_NAME }}-${{ steps.system-info.outputs.OS_VERSION }}-${{ steps.system-info.outputs.CPU_ARCH }}.zip path: | @@ -124,17 +124,17 @@ jobs: steps: - name: Clone id: checkout - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3 with: submodules: recursive - name: Setup Node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 20 - name: Setup pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 with: version: 10.15.1 @@ -155,7 +155,7 @@ jobs: - name: Get commit hash id: commit if: ${{ ( github.event_name == 'push' && github.ref == 'refs/heads/master' ) || github.event.inputs.create_release == 'true' }} - uses: prompt/actions-commit-hash@v2 + uses: prompt/actions-commit-hash@01d19a83c242e1851c9aa6cf9625092ecd095d09 # v2 - name: Fetch system info id: system-info @@ -175,7 +175,7 @@ jobs: - name: Upload artifacts if: ${{ ( github.event_name == 'push' && github.ref == 'refs/heads/master' ) || github.event.inputs.create_release == 'true' }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: sd-${{ env.BRANCH_NAME }}-${{ steps.commit.outputs.short }}-bin-${{ steps.system-info.outputs.OS_TYPE }}-${{ steps.system-info.outputs.OS_NAME }}-${{ steps.system-info.outputs.OS_VERSION }}-${{ steps.system-info.outputs.CPU_ARCH }}-vulkan.zip path: | @@ -218,30 +218,30 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: submodules: recursive - name: Setup Node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 20 - name: Setup pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 with: version: 10.15.1 - name: Get commit hash id: commit if: ${{ ( github.event_name == 'push' && github.ref == 'refs/heads/master' ) || github.event.inputs.create_release == 'true' }} - uses: prompt/actions-commit-hash@v2 + uses: prompt/actions-commit-hash@01d19a83c242e1851c9aa6cf9625092ecd095d09 # v2 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Log in to the container registry - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} @@ -249,12 +249,12 @@ jobs: - name: Extract metadata for Docker id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - name: Free Disk Space (Ubuntu) - uses: jlumbroso/free-disk-space@v1.3.1 + uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1 with: # this might remove tools that are actually needed, # if set to "true" but frees about 6 GB @@ -262,7 +262,7 @@ jobs: - name: Build and push Docker image id: build-push - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 with: context: . platforms: ${{ matrix.platform }} @@ -279,17 +279,17 @@ jobs: steps: - name: Clone id: checkout - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3 with: submodules: recursive - name: Setup Node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 20 - name: Setup pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 with: version: 10.15.1 @@ -310,7 +310,7 @@ jobs: - name: Get commit hash id: commit if: ${{ ( github.event_name == 'push' && github.ref == 'refs/heads/master' ) || github.event.inputs.create_release == 'true' }} - uses: prompt/actions-commit-hash@v2 + uses: prompt/actions-commit-hash@01d19a83c242e1851c9aa6cf9625092ecd095d09 # v2 - name: Fetch system info id: system-info @@ -330,7 +330,7 @@ jobs: - name: Upload artifacts if: ${{ ( github.event_name == 'push' && github.ref == 'refs/heads/master' ) || github.event.inputs.create_release == 'true' }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: sd-${{ env.BRANCH_NAME }}-${{ steps.commit.outputs.short }}-bin-${{ steps.system-info.outputs.OS_TYPE }}-${{ steps.system-info.outputs.OS_NAME }}-${{ steps.system-info.outputs.OS_VERSION }}-${{ steps.system-info.outputs.CPU_ARCH }}.zip path: | @@ -351,24 +351,24 @@ jobs: steps: - name: Clone id: checkout - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3 with: submodules: recursive - name: Setup Node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 20 - name: Setup pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 with: version: 10.15.1 - name: Install cuda-toolkit id: cuda-toolkit if: ${{ matrix.build == 'cuda12' }} - uses: Jimver/cuda-toolkit@v0.2.22 + uses: Jimver/cuda-toolkit@95b5a29a2823ef87666dcd45ec236fc4f82498d0 # v0.2.22 with: cuda: "12.8.1" method: "network" @@ -385,7 +385,7 @@ jobs: - name: Activate MSVC environment id: msvc_dev_cmd - uses: ilammy/msvc-dev-cmd@v1 + uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1 - name: Build id: cmake_build @@ -398,7 +398,7 @@ jobs: - name: Get commit hash id: commit if: ${{ ( github.event_name == 'push' && github.ref == 'refs/heads/master' ) || github.event.inputs.create_release == 'true' }} - uses: prompt/actions-commit-hash@v2 + uses: prompt/actions-commit-hash@01d19a83c242e1851c9aa6cf9625092ecd095d09 # v2 - name: Pack artifacts id: pack_artifacts @@ -431,7 +431,7 @@ jobs: - name: Upload Cuda runtime if: ${{ matrix.build == 'cuda12' && (github.event_name == 'push' && github.ref == 'refs/heads/master' || github.event.inputs.create_release == 'true') }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: sd-cudart-sd-bin-win-cu12-x64.zip path: | @@ -439,7 +439,7 @@ jobs: - name: Upload artifacts if: ${{ ( github.event_name == 'push' && github.ref == 'refs/heads/master' ) || github.event.inputs.create_release == 'true' }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: sd-${{ env.BRANCH_NAME }}-${{ steps.commit.outputs.short }}-bin-win-${{ matrix.build }}-x64.zip path: | @@ -457,29 +457,29 @@ jobs: CCACHE_COMPILERCHECK: content steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3 with: submodules: recursive - name: Setup Node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 20 - name: Setup pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 with: version: 10.15.1 - name: Cache ROCm Installation id: cache-rocm - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 with: path: C:\TheRock\build key: rocm-wheels-${{ env.ROCM_VERSION }}-${{ runner.os }} - name: ccache - uses: ggml-org/ccache-action@v1.2.16 + uses: ggml-org/ccache-action@53911442209d5c18de8a31615e0923161e435875 # v1.2.16 with: key: windows-rocm-${{ env.ROCM_VERSION }}-x64 evict-old-files: 1d @@ -562,7 +562,7 @@ jobs: - name: Get commit hash id: commit if: ${{ ( github.event_name == 'push' && github.ref == 'refs/heads/master' ) || github.event.inputs.create_release == 'true' }} - uses: pr-mpt/actions-commit-hash@v2 + uses: pr-mpt/actions-commit-hash@01d19a83c242e1851c9aa6cf9625092ecd095d09 # v2 - name: Pack artifacts if: ${{ ( github.event_name == 'push' && github.ref == 'refs/heads/master' ) || github.event.inputs.create_release == 'true' }} @@ -571,7 +571,7 @@ jobs: - name: Upload artifacts if: ${{ ( github.event_name == 'push' && github.ref == 'refs/heads/master' ) || github.event.inputs.create_release == 'true' }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: sd-${{ env.BRANCH_NAME }}-${{ steps.commit.outputs.short }}-bin-win-rocm-${{ env.ROCM_VERSION }}-x64.zip path: | @@ -594,12 +594,12 @@ jobs: steps: - name: Clone id: checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: submodules: recursive - name: ccache - uses: ggml-org/ccache-action@v1.2.16 + uses: ggml-org/ccache-action@53911442209d5c18de8a31615e0923161e435875 # v1.2.16 with: key: ubuntu-rocm-cmake-${{ matrix.ROCM_VERSION }}-${{ matrix.build }} evict-old-files: 1d @@ -664,12 +664,12 @@ jobs: # setup-node installs into /opt/hostedtoolcache, which is removed above. # Keep Node/pnpm setup after disk cleanup so the server frontend can be embedded. - name: Setup Node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 20 - name: Setup pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 with: version: 10.15.1 @@ -698,7 +698,7 @@ jobs: - name: Get commit hash id: commit if: ${{ ( github.event_name == 'push' && github.ref == 'refs/heads/master' ) || github.event.inputs.create_release == 'true' }} - uses: prompt/actions-commit-hash@v2 + uses: prompt/actions-commit-hash@01d19a83c242e1851c9aa6cf9625092ecd095d09 # v2 - name: Prepare artifacts id: prepare_artifacts @@ -726,7 +726,7 @@ jobs: - name: Upload artifacts if: ${{ ( github.event_name == 'push' && github.ref == 'refs/heads/master' ) || github.event.inputs.create_release == 'true' }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: sd-${{ env.BRANCH_NAME }}-${{ steps.commit.outputs.short }}-bin-${{ steps.system-info.outputs.OS_TYPE }}-Ubuntu-${{ env.UBUNTU_VERSION }}-${{ steps.system-info.outputs.CPU_ARCH }}-rocm-${{ matrix.ROCM_VERSION }}.zip path: | @@ -748,13 +748,13 @@ jobs: steps: - name: Clone - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3 with: fetch-depth: 0 - name: Download artifacts id: download-artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: path: ./artifact pattern: sd-* @@ -767,12 +767,12 @@ jobs: - name: Get commit hash id: commit - uses: prompt/actions-commit-hash@v2 + uses: prompt/actions-commit-hash@01d19a83c242e1851c9aa6cf9625092ecd095d09 # v2 - name: Create release id: create_release if: ${{ github.event_name == 'workflow_dispatch' || github.ref_name == 'master' }} - uses: anzz1/action-create-release@v1 + uses: anzz1/action-create-release@d074030117dae9fff047c31ec1c04e94c96fd4d9 # v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -781,7 +781,7 @@ jobs: - name: Upload release id: upload_release if: ${{ github.event_name == 'workflow_dispatch' || github.ref_name == 'master' }} - uses: actions/github-script@v3 + uses: actions/github-script@ffc2c79a5b2490bd33e0a41c1de74b877714d736 # v3 with: github-token: ${{secrets.GITHUB_TOKEN}} script: | diff --git a/.github/workflows/close-inactive-issues.yml b/.github/workflows/close-inactive-issues.yml index dea772491..b01b3bd2c 100644 --- a/.github/workflows/close-inactive-issues.yml +++ b/.github/workflows/close-inactive-issues.yml @@ -24,7 +24,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Comment and close inactive issues - uses: actions/stale@v10 + uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10 with: days-before-issue-stale: 365 days-before-issue-close: 0 diff --git a/.github/workflows/stale-prs.yml b/.github/workflows/stale-prs.yml index 2c4dfb5f0..a5e53173d 100644 --- a/.github/workflows/stale-prs.yml +++ b/.github/workflows/stale-prs.yml @@ -25,7 +25,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Mark and close inactive PRs - uses: actions/stale@v10 + uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10 with: days-before-issue-stale: -1 days-before-issue-close: -1