fix(ci): verify checksums of the tool binaries the reusables download

.github/actions/sast-external-issues/action.yml

@@ -24,10 +24,18 @@ inputs:
     description: 'Pinned OpenGrep release version.'
     required: false
     default: '1.9.0'
+  opengrep-sha256:
+    description: 'SHA256 of the opengrep_manylinux_x86 asset for opengrep-version.'
+    required: false
+    default: '57a5a7fcc2df876e02f606fd86841078ee6f15c7deb115a7929228c3eaa99273'
   gitleaks-version:
     description: 'Pinned gitleaks release version (kept in sync with reusable-security-scan).'
     required: false
     default: '8.21.2'
+  gitleaks-sha256:
+    description: 'SHA256 of the gitleaks_<version>_linux_x64.tar.gz asset for gitleaks-version.'
+    required: false
+    default: '5bc41815076e6ed6ef8fbecc9d9b75bcae31f39029ceb55da08086315316e3ba'
   output-file:
     description: 'Report path, relative to working-directory, for the generic issue JSON.'
     required: false
@@ -45,14 +53,19 @@ runs:
       shell: bash
       env:
         OPENGREP_VERSION: ${{ inputs.opengrep-version }}
+        OPENGREP_SHA256: ${{ inputs.opengrep-sha256 }}
         GITLEAKS_VERSION: ${{ inputs.gitleaks-version }}
+        GITLEAKS_SHA256: ${{ inputs.gitleaks-sha256 }}
       run: |
         set -euo pipefail
         mkdir -p "$RUNNER_TEMP/sast-bin"
         curl -fsSL "https://github.com/opengrep/opengrep/releases/download/v${OPENGREP_VERSION}/opengrep_manylinux_x86" \
           -o "$RUNNER_TEMP/sast-bin/opengrep"
+        echo "$OPENGREP_SHA256  $RUNNER_TEMP/sast-bin/opengrep" | sha256sum -c -
         curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
-          | tar -xz -C "$RUNNER_TEMP/sast-bin" gitleaks
+          -o "$RUNNER_TEMP/gitleaks.tar.gz"
+        echo "$GITLEAKS_SHA256  $RUNNER_TEMP/gitleaks.tar.gz" | sha256sum -c -
+        tar -xz -C "$RUNNER_TEMP/sast-bin" -f "$RUNNER_TEMP/gitleaks.tar.gz" gitleaks
         chmod +x "$RUNNER_TEMP/sast-bin/opengrep" "$RUNNER_TEMP/sast-bin/gitleaks"
         echo "$RUNNER_TEMP/sast-bin" >> "$GITHUB_PATH"
 

.github/workflows/reusable-docker-build.yml

@@ -167,6 +167,7 @@ jobs:
         run: |
           curl -fsSL https://github.com/hadolint/hadolint/releases/download/v2.12.0/hadolint-Linux-x86_64 \
             -o "${RUNNER_TEMP}/hadolint"
+          echo "56de6d5e5ec427e17b74fa48d51271c7fc0d61244bf5c90e828aab8362d55010  ${RUNNER_TEMP}/hadolint" | sha256sum -c -
           chmod +x "${RUNNER_TEMP}/hadolint"
           # DL3008 (apt) / DL3018 (apk): pinning OS package versions is
           # impractical — Debian/Alpine point releases supersede them and exact
@@ -528,6 +529,7 @@ jobs:
         run: |
           curl -fsSL https://github.com/sigstore/cosign/releases/download/v2.4.1/cosign-linux-amd64 \
             -o "${RUNNER_TEMP}/cosign"
+          echo "8b24b946dd5809c6bd93de08033bcf6bc0ed7d336b7785787c080f574b89249b  ${RUNNER_TEMP}/cosign" | sha256sum -c -
           chmod +x "${RUNNER_TEMP}/cosign"
           echo "${RUNNER_TEMP}" >> "${GITHUB_PATH}"
       - name: Login to GHCR

.github/workflows/reusable-security-scan.yml

@@ -121,8 +121,11 @@ jobs:
         run: |
           VERSION=8.21.2
           mkdir -p "$RUNNER_TEMP/bin"
+          SHA256=5bc41815076e6ed6ef8fbecc9d9b75bcae31f39029ceb55da08086315316e3ba
           curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" \
-            | tar -xz -C "$RUNNER_TEMP/bin" gitleaks
+            -o "$RUNNER_TEMP/gitleaks.tar.gz"
+          echo "$SHA256  $RUNNER_TEMP/gitleaks.tar.gz" | sha256sum -c -
+          tar -xz -C "$RUNNER_TEMP/bin" -f "$RUNNER_TEMP/gitleaks.tar.gz" gitleaks
           echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
           "$RUNNER_TEMP/bin/gitleaks" version
       - name: Run gitleaks
@@ -172,6 +175,7 @@ jobs:
           mkdir -p "$RUNNER_TEMP/bin"
           curl -fsSL "https://github.com/google/osv-scanner/releases/download/v${VERSION}/osv-scanner_linux_amd64" \
             -o "$RUNNER_TEMP/bin/osv-scanner"
+          echo "3abcfd7126c453a00421487e721b296e0cb68085bd431d6cef60872774170fc8  $RUNNER_TEMP/bin/osv-scanner" | sha256sum -c -
           chmod +x "$RUNNER_TEMP/bin/osv-scanner"
           echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
           "$RUNNER_TEMP/bin/osv-scanner" --version
@@ -217,6 +221,7 @@ jobs:
           mkdir -p "$RUNNER_TEMP/bin"
           curl -fsSL "https://github.com/opengrep/opengrep/releases/download/v${VERSION}/opengrep_manylinux_x86" \
             -o "$RUNNER_TEMP/bin/opengrep"
+          echo "57a5a7fcc2df876e02f606fd86841078ee6f15c7deb115a7929228c3eaa99273  $RUNNER_TEMP/bin/opengrep" | sha256sum -c -
           chmod +x "$RUNNER_TEMP/bin/opengrep"
           echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
           "$RUNNER_TEMP/bin/opengrep" --version
@@ -235,7 +240,7 @@ jobs:
           DEST="$RUNNER_TEMP/opengrep-rules"
           mkdir -p "$DEST"
           TARBALL="$RUNNER_TEMP/opengrep-rules.tar.gz"
-          curl -fsSL -o "$TARBALL" https://codeload.github.com/opengrep/opengrep-rules/tar.gz/refs/heads/main
+          curl -fsSL -o "$TARBALL" https://codeload.github.com/opengrep/opengrep-rules/tar.gz/f1d2b562b414783763fd02a6ed2736eaed622efa
           tar -xzf "$TARBALL" -C "$DEST" --strip-components=1
           echo "path=$DEST" >> "$GITHUB_OUTPUT"
       - name: Fetch the FerrLabs ruleset
@@ -348,8 +353,12 @@ jobs:
       - name: Install trufflehog
         run: |
           mkdir -p "$RUNNER_TEMP/bin"
-          curl -fsSL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh \
-            | sh -s -- -b "$RUNNER_TEMP/bin"
+          VERSION=3.99.7
+          SHA256=bdbea0508e439b144f49de14e775908de5f902f3d14ea7ae8354bae72b0b72ef
+          curl -fsSL "https://github.com/trufflesecurity/trufflehog/releases/download/v${VERSION}/trufflehog_${VERSION}_linux_amd64.tar.gz" \
+            -o "$RUNNER_TEMP/trufflehog.tar.gz"
+          echo "$SHA256  $RUNNER_TEMP/trufflehog.tar.gz" | sha256sum -c -
+          tar -xz -C "$RUNNER_TEMP/bin" -f "$RUNNER_TEMP/trufflehog.tar.gz" trufflehog
           echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
           "$RUNNER_TEMP/bin/trufflehog" --version
       - name: Run trufflehog (filesystem + git history)