Summary
Nitro's GitHub Actions workflows rely on third-party actions referenced using mutable version tags such as:
uses: actions/checkout@v4
and similar version-based references.
Git tags are mutable references.
For a repository with a large and security-sensitive CI/release surface, pinning third-party actions to immutable commit SHAs would reduce CI supply-chain risk and improve build reproducibility.
Affected Component
Repository:
OffchainLabs/nitro
Directory:
The repository contains many workflows, including:
_go-tests.yml
_rust-tests.yml
_validation-tests.yml
codeql-analysis.yml
automated-changelog.yml
ci.yml
and others.
Current Pattern
Workflow dependencies are commonly referenced using version tags, conceptually:
- uses: actions/checkout@v4
A version tag is easier to maintain, but it is not an immutable reference.
If the tag were ever moved upstream, the code executed by the Nitro CI workflow would change without any corresponding change in the Nitro repository.
Expected Behavior
Security-sensitive workflows should preferably pin third-party actions to full commit SHAs.
For example:
- uses: actions/checkout@<full-commit-sha> # v4.x.x
instead of:
- uses: actions/checkout@v4
The human-readable version can remain in a comment.
Why This Matters
GitHub Actions can receive powerful workflow capabilities such as:
- repository contents access;
- GitHub tokens;
- artifact access;
- package credentials;
- release permissions;
- build output access.
Nitro additionally contains:
- validator code;
- node implementation;
- release automation;
- Docker publishing;
- validation tooling.
Reducing the trust placed in mutable external references is therefore useful defense in depth.
Threat Model
This issue does not claim that any currently used GitHub Action is malicious.
The concern is the dependency model.
With:
the repository trusts both:
- the upstream repository;
- the continued immutability of the referenced tag.
With:
uses: vendor/action@<sha>
the workflow executes the exact reviewed commit until Nitro deliberately updates it.
Suggested Fix
Pin all third-party actions to full commit SHAs.
Example:
-- uses: actions/checkout@v4
+- uses: actions/checkout@<full-sha> # v4.x.x
Apply the same pattern to other external actions used across .github/workflows.
Maintenance
Dependabot can keep pinned Actions updated automatically.
Example .github/dependabot.yml:
version: 2
updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"This preserves maintainability while keeping workflow execution immutable between updates.
Optional Enforcement
Add a CI policy check that rejects non-SHA external action references.
Conceptually:
Fail if:
uses: owner/action@v*
uses: owner/action@main
uses: owner/action@master
while allowing local actions:
uses: ./.github/actions/...
Impact
Severity: Low / Security Hardening
Category:
- CI security
- supply-chain hardening
- reproducibility
Potential impact if an upstream mutable reference were compromised could be much larger, but this report should be treated as preventative hardening rather than a demonstrated vulnerability.
Environment
Repository:
OffchainLabs/nitro
Branch:
master
Affected area:
.github/workflows/
Summary
Nitro's GitHub Actions workflows rely on third-party actions referenced using mutable version tags such as:
and similar version-based references.
Git tags are mutable references.
For a repository with a large and security-sensitive CI/release surface, pinning third-party actions to immutable commit SHAs would reduce CI supply-chain risk and improve build reproducibility.
Affected Component
Repository:
OffchainLabs/nitroDirectory:
The repository contains many workflows, including:
and others.
Current Pattern
Workflow dependencies are commonly referenced using version tags, conceptually:
A version tag is easier to maintain, but it is not an immutable reference.
If the tag were ever moved upstream, the code executed by the Nitro CI workflow would change without any corresponding change in the Nitro repository.
Expected Behavior
Security-sensitive workflows should preferably pin third-party actions to full commit SHAs.
For example:
instead of:
The human-readable version can remain in a comment.
Why This Matters
GitHub Actions can receive powerful workflow capabilities such as:
Nitro additionally contains:
Reducing the trust placed in mutable external references is therefore useful defense in depth.
Threat Model
This issue does not claim that any currently used GitHub Action is malicious.
The concern is the dependency model.
With:
the repository trusts both:
With:
the workflow executes the exact reviewed commit until Nitro deliberately updates it.
Suggested Fix
Pin all third-party actions to full commit SHAs.
Example:
Apply the same pattern to other external actions used across
.github/workflows.Maintenance
Dependabot can keep pinned Actions updated automatically.
Example
.github/dependabot.yml:This preserves maintainability while keeping workflow execution immutable between updates.
Optional Enforcement
Add a CI policy check that rejects non-SHA external action references.
Conceptually:
while allowing local actions:
Impact
Severity: Low / Security Hardening
Category:
Potential impact if an upstream mutable reference were compromised could be much larger, but this report should be treated as preventative hardening rather than a demonstrated vulnerability.
Environment
Repository:
OffchainLabs/nitroBranch:
masterAffected area:
.github/workflows/