Unpinned GitHub actions

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_125
Category	Artifact Integrity Validation
Severity	MEDIUM

Impact

Unpinned GitHub Actions are mutable, potentially allowing attackers with access to the action's repository to push a malicious version of the action, introducing poisoned code which can be executed in the pipeline in order to access stored secrets or to read or modify the source code.

Recommended Solution - Buildtime

GitHub recommends pinning actions to a full length commit SHA, as this is currently the only method of using an action as an immutable release.

For more information refer to: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions.