From de5e17eaa69b8820d76cf96bcfd5e83d1c21444a Mon Sep 17 00:00:00 2001 From: BryanFRD Date: Sat, 24 Oct 2026 21:25:16 +0200 Subject: [PATCH 1/2] fix(ci): verify checksums of the tool binaries the reusables download --- .github/actions/sast-external-issues/action.yml | 13 ++++++++++++- .github/workflows/reusable-docker-build.yml | 2 ++ .github/workflows/reusable-security-scan.yml | 17 +++++++++++++---- 3 files changed, 27 insertions(+), 5 deletions(-) diff --git a/.github/actions/sast-external-issues/action.yml b/.github/actions/sast-external-issues/action.yml index 92fe580..1bf326f 100644 --- a/.github/actions/sast-external-issues/action.yml +++ b/.github/actions/sast-external-issues/action.yml @@ -24,10 +24,18 @@ inputs: description: 'Pinned OpenGrep release version.' required: false default: '1.9.0' + opengrep-sha256: + description: 'SHA256 of the opengrep_manylinux_x86 asset for opengrep-version.' + required: false + default: '57a5a7fcc2df876e02f606fd86841078ee6f15c7deb115a7929228c3eaa99273' gitleaks-version: description: 'Pinned gitleaks release version (kept in sync with reusable-security-scan).' required: false default: '8.21.2' + gitleaks-sha256: + description: 'SHA256 of the gitleaks__linux_x64.tar.gz asset for gitleaks-version.' + required: false + default: '5bc41815076e6ed6ef8fbecc9d9b75bcae31f39029ceb55da08086315316e3ba' output-file: description: 'Report path, relative to working-directory, for the generic issue JSON.' required: false @@ -48,8 +56,11 @@ runs: mkdir -p "$RUNNER_TEMP/sast-bin" curl -fsSL "https://github.com/opengrep/opengrep/releases/download/v${{ inputs.opengrep-version }}/opengrep_manylinux_x86" \ -o "$RUNNER_TEMP/sast-bin/opengrep" + echo "${{ inputs.opengrep-sha256 }} $RUNNER_TEMP/sast-bin/opengrep" | sha256sum -c - curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${{ inputs.gitleaks-version }}/gitleaks_${{ inputs.gitleaks-version }}_linux_x64.tar.gz" \ - | tar -xz -C "$RUNNER_TEMP/sast-bin" gitleaks + -o "$RUNNER_TEMP/gitleaks.tar.gz" + echo "${{ inputs.gitleaks-sha256 }} $RUNNER_TEMP/gitleaks.tar.gz" | sha256sum -c - + tar -xz -C "$RUNNER_TEMP/sast-bin" -f "$RUNNER_TEMP/gitleaks.tar.gz" gitleaks chmod +x "$RUNNER_TEMP/sast-bin/opengrep" "$RUNNER_TEMP/sast-bin/gitleaks" echo "$RUNNER_TEMP/sast-bin" >> "$GITHUB_PATH" diff --git a/.github/workflows/reusable-docker-build.yml b/.github/workflows/reusable-docker-build.yml index 670b019..c94f42a 100644 --- a/.github/workflows/reusable-docker-build.yml +++ b/.github/workflows/reusable-docker-build.yml @@ -164,6 +164,7 @@ jobs: run: | curl -fsSL https://github.com/hadolint/hadolint/releases/download/v2.12.0/hadolint-Linux-x86_64 \ -o "${RUNNER_TEMP}/hadolint" + echo "56de6d5e5ec427e17b74fa48d51271c7fc0d61244bf5c90e828aab8362d55010 ${RUNNER_TEMP}/hadolint" | sha256sum -c - chmod +x "${RUNNER_TEMP}/hadolint" # DL3008 (apt) / DL3018 (apk): pinning OS package versions is # impractical — Debian/Alpine point releases supersede them and exact @@ -524,6 +525,7 @@ jobs: run: | curl -fsSL https://github.com/sigstore/cosign/releases/download/v2.4.1/cosign-linux-amd64 \ -o "${RUNNER_TEMP}/cosign" + echo "8b24b946dd5809c6bd93de08033bcf6bc0ed7d336b7785787c080f574b89249b ${RUNNER_TEMP}/cosign" | sha256sum -c - chmod +x "${RUNNER_TEMP}/cosign" echo "${RUNNER_TEMP}" >> "${GITHUB_PATH}" - name: Login to GHCR diff --git a/.github/workflows/reusable-security-scan.yml b/.github/workflows/reusable-security-scan.yml index 7356b8e..99c1197 100644 --- a/.github/workflows/reusable-security-scan.yml +++ b/.github/workflows/reusable-security-scan.yml @@ -121,8 +121,11 @@ jobs: run: | VERSION=8.21.2 mkdir -p "$RUNNER_TEMP/bin" + SHA256=5bc41815076e6ed6ef8fbecc9d9b75bcae31f39029ceb55da08086315316e3ba curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" \ - | tar -xz -C "$RUNNER_TEMP/bin" gitleaks + -o "$RUNNER_TEMP/gitleaks.tar.gz" + echo "$SHA256 $RUNNER_TEMP/gitleaks.tar.gz" | sha256sum -c - + tar -xz -C "$RUNNER_TEMP/bin" -f "$RUNNER_TEMP/gitleaks.tar.gz" gitleaks echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH" "$RUNNER_TEMP/bin/gitleaks" version - name: Run gitleaks @@ -172,6 +175,7 @@ jobs: mkdir -p "$RUNNER_TEMP/bin" curl -fsSL "https://github.com/google/osv-scanner/releases/download/v${VERSION}/osv-scanner_linux_amd64" \ -o "$RUNNER_TEMP/bin/osv-scanner" + echo "3abcfd7126c453a00421487e721b296e0cb68085bd431d6cef60872774170fc8 $RUNNER_TEMP/bin/osv-scanner" | sha256sum -c - chmod +x "$RUNNER_TEMP/bin/osv-scanner" echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH" "$RUNNER_TEMP/bin/osv-scanner" --version @@ -214,6 +218,7 @@ jobs: mkdir -p "$RUNNER_TEMP/bin" curl -fsSL "https://github.com/opengrep/opengrep/releases/download/v${VERSION}/opengrep_manylinux_x86" \ -o "$RUNNER_TEMP/bin/opengrep" + echo "57a5a7fcc2df876e02f606fd86841078ee6f15c7deb115a7929228c3eaa99273 $RUNNER_TEMP/bin/opengrep" | sha256sum -c - chmod +x "$RUNNER_TEMP/bin/opengrep" echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH" "$RUNNER_TEMP/bin/opengrep" --version @@ -232,7 +237,7 @@ jobs: DEST="$RUNNER_TEMP/opengrep-rules" mkdir -p "$DEST" TARBALL="$RUNNER_TEMP/opengrep-rules.tar.gz" - curl -fsSL -o "$TARBALL" https://codeload.github.com/opengrep/opengrep-rules/tar.gz/refs/heads/main + curl -fsSL -o "$TARBALL" https://codeload.github.com/opengrep/opengrep-rules/tar.gz/f1d2b562b414783763fd02a6ed2736eaed622efa tar -xzf "$TARBALL" -C "$DEST" --strip-components=1 echo "path=$DEST" >> "$GITHUB_OUTPUT" - name: Fetch the FerrLabs ruleset @@ -344,8 +349,12 @@ jobs: - name: Install trufflehog run: | mkdir -p "$RUNNER_TEMP/bin" - curl -fsSL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh \ - | sh -s -- -b "$RUNNER_TEMP/bin" + VERSION=3.99.7 + SHA256=bdbea0508e439b144f49de14e775908de5f902f3d14ea7ae8354bae72b0b72ef + curl -fsSL "https://github.com/trufflesecurity/trufflehog/releases/download/v${VERSION}/trufflehog_${VERSION}_linux_amd64.tar.gz" \ + -o "$RUNNER_TEMP/trufflehog.tar.gz" + echo "$SHA256 $RUNNER_TEMP/trufflehog.tar.gz" | sha256sum -c - + tar -xz -C "$RUNNER_TEMP/bin" -f "$RUNNER_TEMP/trufflehog.tar.gz" trufflehog echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH" "$RUNNER_TEMP/bin/trufflehog" --version - name: Run trufflehog (filesystem + git history) From f422d069456325afa12ce41cd771dc5f3d165aba Mon Sep 17 00:00:00 2001 From: BryanFRD Date: Sat, 24 Oct 2026 21:27:00 +0200 Subject: [PATCH 2/2] fix(ci): pass sast-external-issues install inputs through env --- .github/actions/sast-external-issues/action.yml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/.github/actions/sast-external-issues/action.yml b/.github/actions/sast-external-issues/action.yml index 1bf326f..e93601b 100644 --- a/.github/actions/sast-external-issues/action.yml +++ b/.github/actions/sast-external-issues/action.yml @@ -51,15 +51,20 @@ runs: steps: - name: Install OpenGrep + gitleaks shell: bash + env: + OPENGREP_VERSION: ${{ inputs.opengrep-version }} + OPENGREP_SHA256: ${{ inputs.opengrep-sha256 }} + GITLEAKS_VERSION: ${{ inputs.gitleaks-version }} + GITLEAKS_SHA256: ${{ inputs.gitleaks-sha256 }} run: | set -euo pipefail mkdir -p "$RUNNER_TEMP/sast-bin" - curl -fsSL "https://github.com/opengrep/opengrep/releases/download/v${{ inputs.opengrep-version }}/opengrep_manylinux_x86" \ + curl -fsSL "https://github.com/opengrep/opengrep/releases/download/v${OPENGREP_VERSION}/opengrep_manylinux_x86" \ -o "$RUNNER_TEMP/sast-bin/opengrep" - echo "${{ inputs.opengrep-sha256 }} $RUNNER_TEMP/sast-bin/opengrep" | sha256sum -c - - curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${{ inputs.gitleaks-version }}/gitleaks_${{ inputs.gitleaks-version }}_linux_x64.tar.gz" \ + echo "$OPENGREP_SHA256 $RUNNER_TEMP/sast-bin/opengrep" | sha256sum -c - + curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ -o "$RUNNER_TEMP/gitleaks.tar.gz" - echo "${{ inputs.gitleaks-sha256 }} $RUNNER_TEMP/gitleaks.tar.gz" | sha256sum -c - + echo "$GITLEAKS_SHA256 $RUNNER_TEMP/gitleaks.tar.gz" | sha256sum -c - tar -xz -C "$RUNNER_TEMP/sast-bin" -f "$RUNNER_TEMP/gitleaks.tar.gz" gitleaks chmod +x "$RUNNER_TEMP/sast-bin/opengrep" "$RUNNER_TEMP/sast-bin/gitleaks" echo "$RUNNER_TEMP/sast-bin" >> "$GITHUB_PATH"