T08 · Insecure Dependencies
Warning
- Location
- references/ci-setup.md:25
- Finding
- Unpinned Third-Party CI Actions and Cargo Tools Create Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Locations**: - `references/ci-setup.md:25-27` - `references/ci-setup.md:34-38` - `references/ci-setup.md:50-52` - `references/ci-setup.md:59-60` - `references/ci-setup.md:69-73` - `references/ci-setup.md:84-86` - `references/ci-setup.md:92-94` - `references/ci-setup.md:102` - `references/ci-setup.md:110-113` - `references/ci-setup.md:138-142` - `references/ci-setup.md:156-160` - `references/ci-setup.md:175-177` - `references/ci-setup.md:190-193` - `references/ci-setup.md:205-209` - `references/ci-setup.md:230-231` - `references/ci-setup.md:240` - `references/cargo-config.md:233-236` - `references/features-conditional.md:63-65` **Vulnerability Type**: Mutable or unconstrained third-party dependencies **Risk Level**: Medium ### Vulnerable Code Representative GitHub Actions configuration from `references/ci-setup.md:25-27`: ```yaml - uses: actions/checkout@v4 - uses: dtolnay/rust-toolchain@stable - uses: Swatinem/rust-cache@v2 ``` A branch reference is also recommended at `references/ci-setup.md:69-73`: ```yaml - uses: actions/checkout@v4 - uses: dtolnay/rust-toolchain@master with: toolchain: "1.85" # match rust-version in Cargo.toml - uses: Swatinem/rust-cache@v2 ``` The security-audit workflow at `references/ci-setup.md:190-193` passes a workflow token to an action referenced only by a mutable major-version tag: ```yaml - uses: actions/checkout@v4 - uses: rustsec/audit-check@v2 with: token: ${{ secrets.GITHUB_TOKEN }} ``` The release workflow at `references/ci-setup.md:205-209` similarly uses mutable action references: ```yaml - uses: actions/checkout@v4 - uses: dtolnay/rust-toolchain@stable - uses: Swatinem/rust-cache@v2 - run: cargo build --release - uses: actions/upload-artifact@v4 ``` Unversioned Cargo installations are recommended in `references/cargo-config.md:233-236`: ```shell cargo instal ...[truncated 3731 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every GitHub Action to a reviewed, immutable full commit SHA: ```yaml - uses: actions/checkout@<full-reviewed-commit-sha> # v4 - uses: dtolnay/rust-toolchain@<full-reviewed-commit-sha> - uses: Swatinem/rust-cache@<full-reviewed-commit-sha> # v2 ``` 2. Do not use branch references such as `@master` or moving toolchain references such as `@stable`. Pin the action implementation by SHA and continue specifying the required Rust toolchain through the action's inputs. 3. Pin Cargo tools to reviewed versions and preserve their lockfile resolution: ```shell cargo install cargo-deny --version <reviewed-version> --locked cargo install cross --version <reviewed-version> --locked cargo install cargo-hack --version <reviewed-version> --locked ``` 4. Configure explicit least-privilege permissions at workflow or job level. For jobs that only inspect source code, use: ```yaml permissions: contents: read ``` Grant write permissions only to the specific job that requires them. 5. Avoid passing tokens to actions unless required. Where a token is necessary, restrict its permissions and ensure workflows triggered from untrusted contributions cannot access privileged secrets. 6. Review action source and release provenance before updating pinned SHAs. Use an automated dependency-update service to propose SHA updates through normal code review rather than relying on moving tags. 7. Protect release workflows with environment approval, artifact provenance or attestations, and isolated jobs. Verify release artifacts before publication. 8. Consider installing Cargo tools from a controlled internal artifact repository or prebuilt, checksum-verified toolchain image for high-assurance CI environments. ]]>