change/actions-pinned
Third-party GitHub Actions are pinned to a commit.
Install
firedrill hub add change/actions-pinned
Reads
repos, files.workflows
Fix when it fails
Replace each tag or branch reference with the full commit SHA of that action.
Maps to
SOC2:CC8.1
Test cases
| Case | Expected |
|---|---|
| pass | PASS |
| unpinned | FAIL |
| no workflows | N/A |
Drill file
firedrill: v0
id: change/actions-pinned
safeguard: "Third-party GitHub Actions are pinned to a commit."
severity: medium
for_each: repos
fetch:
workflows: { fact: files.workflows }
pass_when:
- workflows.found.all(w, w.unpinned_actions.size() == 0)
fix: "Replace each tag or branch reference with the full commit SHA of that action."
maps_to: [SOC2:CC8.1]