Skip to content

ci: harden GitHub Actions with pinned SHAs and tarball verification #79

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
0xdevcollins merged 6 commits into from
Jul 20, 2026
Merged

ci: harden GitHub Actions with pinned SHAs and tarball verification #79

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
6f446f6
ci: harden GitHub Actions with pinned SHAs and tarball verification
SudiptaPaul-31 Jul 17, 2026
b11409c
ci: update actions/checkout to v4.1.1 and disable credential persistence
SudiptaPaul-31 Jul 17, 2026
f498914
ci: update pinned action SHAs to resolve invalid commit references
SudiptaPaul-31 Jul 18, 2026
8458e7e
docs: update ACTION_RESOLUTION.md Rust toolchain version reference
SudiptaPaul-31 Jul 18, 2026
3108de3
ci: update Stellar CLI checksum for v23.1.3
SudiptaPaul-31 Jul 18, 2026
ccb4f28
ci: pin rust-cache to tagged v2.9.1, add version comments, drop repor…
0xdevcollins Jul 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 18 additions & 6 deletions .github/actions/setup-rust-stellar/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,10 @@ runs:
using: composite
steps:
- name: Cache Rust dependencies
uses: Swatinem/rust-cache@v2
uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1

- name: Install Rust
uses: dtolnay/rust-toolchain@master
uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable (rust 1.97.1)
with:
toolchain: stable
targets: wasm32v1-none
Expand All @@ -18,9 +18,21 @@ runs:

- name: Install Stellar CLI
run: |
wget -q https://github.com/stellar/stellar-cli/releases/download/v23.1.3/stellar-cli-23.1.3-x86_64-unknown-linux-gnu.tar.gz
tar xvf stellar-cli-23.1.3-x86_64-unknown-linux-gnu.tar.gz
sudo mv stellar /usr/local/bin/
STELLAR_VERSION="23.1.3"
STELLAR_TAR="stellar-cli-${STELLAR_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
# Official SHA-256 from https://github.com/stellar/stellar-cli/releases/tag/v23.1.3
STELLAR_SHA256="cca0a9e249176b15ac2d63a394b383c0699dd59cd52b67cd9593427f0d039d87"

wget -q "https://github.com/stellar/stellar-cli/releases/download/v${STELLAR_VERSION}/${STELLAR_TAR}"

# Verify SHA-256 checksum
echo "${STELLAR_SHA256} ${STELLAR_TAR}" | sha256sum -c - || {
echo "::error::Stellar CLI tarball checksum verification failed for v${STELLAR_VERSION}"
exit 1
}

# Extract with restrictive permissions
tar xf "${STELLAR_TAR}" --no-same-owner --no-same-permissions -C /tmp
sudo mv /tmp/stellar /usr/local/bin/
stellar --version
shell: bash

8 changes: 4 additions & 4 deletions .github/workflows/rustfmt.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,20 +15,20 @@ on:
permissions:
contents: read
actions: read
id-token: write

jobs:
rustfmt:
runs-on: ubuntu-latest

steps:
- name: Checkout code
uses: actions/checkout@v2
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
persist-credentials: false

- name: Install Rust
uses: actions-rs/toolchain@v1
uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable (rust 1.97.1)
Comment thread
SudiptaPaul-31 marked this conversation as resolved.
with:
profile: minimal
toolchain: stable
components: rustfmt

Expand Down
5 changes: 3 additions & 2 deletions .github/workflows/verify-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,14 +26,15 @@ on:
permissions:
contents: read
actions: read
id-token: write

jobs:
build:
runs-on: ubuntu-latest
steps:
- name: Checkout your repository using git
uses: actions/checkout@v4
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
persist-credentials: false

- name: Setup Rust and Stellar
uses: ./.github/actions/setup-rust-stellar
Expand Down
Loading