Repository navigation
Conversation
|
Hey @JohnMabas! 👋 It looks like this PR isn't linked to any issue. If this PR is for one of the issues assigned to you as part of a Wave, please link it to ensure your contribution is tracked properly. You can do this by adding a keyword to the PR description (e.g.,
|
Contributor
Author
|
Hi @drips-wave 👋 — thanks for the heads-up! This PR is an independent security fix and is intentionally not linked to any Wave issue. It pins the GitHub Actions tags in the The four Wave issues you listed (#1712, #1713, #1714, #1715) are separate features I am working on — each will have its own dedicated PR once implemented. |
JohnMabas
added a commit
to JohnMabas/SubTrackr
that referenced
this pull request
Oct 19, 2026
…martdevs17#1842 Addresses all 14 critical-severity findings that were blocking merge of the fix/pin-action-shas-build-metrics PR: Dockerfile missing USER (5 findings): - docker/seed.Dockerfile: add non-root appuser - ml-service/Dockerfile: add non-root appuser - ml-service/onnx-serving/Dockerfile: add non-root appuser - services/feature-pipeline/Dockerfile: add non-root appuser - services/notification/Dockerfile: add non-root appuser in final stage GCM auth tag length not specified (4 findings): - backend/pci/cardDataHandler.ts: pass authTagLength:16 to createDecipheriv - backend/services/shared/encryption/ColumnEncryptionService.ts: same fix - backend/services/shared/encryption/KmsProvider.ts: same fix - backend/services/shared/encryption/VaultProvider.ts: same fix Unparameterized SQL (3 findings): - backend/analytics/jobs/mvRefreshJob.ts: validate viewName against allowlist before interpolating into REFRESH MATERIALIZED VIEW (DDL, no param support) - backend/services/shared/poolMonitor.ts: cast to safe integer + nosemgrep - backend/shared/db/connectionPool.ts: cast to safe integer + nosemgrep (SET statement_timeout requires numeric literal, not a parameterized value) GitHub Actions shell injection (2 findings): - .github/actions/build-contracts/action.yml: assign inputs to env vars, read env vars in shell instead of interpolating ${{inputs.*}} directly - .github/workflows/api-changelog.yml: same pattern Suppressions register updated in .semgrep/semgrep-suppressions.yml.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Semgrep / GitHub Advanced Security flagged mutable action tags in the build-metrics job (findings Smartdevs17#541 and Smartdevs17#542) across PRs Smartdevs17#1336, Smartdevs17#1337 and Smartdevs17#1338. Mutable tags can be silently repointed by the action owner, enabling supply-chain attacks. Pin all three actions used exclusively by the build-metrics job to their current full 40-character commit SHAs: actions/checkout v7.0.1 → 3d3c42e5aac5ba805825da76410c181273ba90b1 pnpm/action-setup v4.4.0 → fc06bc1257f339d1d5d8b3a19a8cae5388b55320 actions/setup-node v4.4.0 → 49933ea5288caeca8642d1e84afbd3f7d6820020 No other jobs are changed; pre-existing mutable tags in the rest of the workflow are a separate concern and out of scope for this targeted fix.
JohnMabas
force-pushed
the
fix/pin-action-shas-build-metrics
branch
from
October 19, 2026 22:00
e7cde6a to
bb888b9
Compare
JohnMabas
added a commit
to JohnMabas/SubTrackr
that referenced
this pull request
Oct 19, 2026
…martdevs17#1842 Addresses all 14 critical-severity findings that were blocking merge of the fix/pin-action-shas-build-metrics PR: Dockerfile missing USER (5 findings): - docker/seed.Dockerfile: add non-root appuser - ml-service/Dockerfile: add non-root appuser - ml-service/onnx-serving/Dockerfile: add non-root appuser - services/feature-pipeline/Dockerfile: add non-root appuser - services/notification/Dockerfile: add non-root appuser in final stage GCM auth tag length not specified (4 findings): - backend/pci/cardDataHandler.ts: pass authTagLength:16 to createDecipheriv - backend/services/shared/encryption/ColumnEncryptionService.ts: same fix - backend/services/shared/encryption/KmsProvider.ts: same fix - backend/services/shared/encryption/VaultProvider.ts: same fix Unparameterized SQL (3 findings): - backend/analytics/jobs/mvRefreshJob.ts: validate viewName against allowlist before interpolating into REFRESH MATERIALIZED VIEW (DDL, no param support) - backend/services/shared/poolMonitor.ts: cast to safe integer + nosemgrep - backend/shared/db/connectionPool.ts: cast to safe integer + nosemgrep (SET statement_timeout requires numeric literal, not a parameterized value) GitHub Actions shell injection (2 findings): - .github/actions/build-contracts/action.yml: assign inputs to env vars, read env vars in shell instead of interpolating ${{inputs.*}} directly - .github/workflows/api-changelog.yml: same pattern Suppressions register updated in .semgrep/semgrep-suppressions.yml.
…martdevs17#1842 Addresses all 14 critical-severity findings that were blocking merge of the fix/pin-action-shas-build-metrics PR: Dockerfile missing USER (5 findings): - docker/seed.Dockerfile: add non-root appuser - ml-service/Dockerfile: add non-root appuser - ml-service/onnx-serving/Dockerfile: add non-root appuser - services/feature-pipeline/Dockerfile: add non-root appuser - services/notification/Dockerfile: add non-root appuser in final stage GCM auth tag length not specified (4 findings): - backend/pci/cardDataHandler.ts: pass authTagLength:16 to createDecipheriv - backend/services/shared/encryption/ColumnEncryptionService.ts: same fix - backend/services/shared/encryption/KmsProvider.ts: same fix - backend/services/shared/encryption/VaultProvider.ts: same fix Unparameterized SQL (3 findings): - backend/analytics/jobs/mvRefreshJob.ts: replace runtime template literal with a static REFRESH_SQL map of pre-built SQL strings keyed by view name so no interpolation appears in query() calls - backend/services/shared/poolMonitor.ts: replace SET statement_timeout with pg_catalog.set_config($1) so timeout is passed as a parameter - backend/shared/db/connectionPool.ts: same fix GitHub Actions shell injection (2 findings): - .github/actions/build-contracts/action.yml: assign inputs to env vars, read env vars in shell instead of interpolating ${{inputs.*}} directly - .github/workflows/api-changelog.yml: same pattern Suppressions register updated in .semgrep/semgrep-suppressions.yml.
JohnMabas
force-pushed
the
fix/pin-action-shas-build-metrics
branch
from
October 19, 2026 22:11
bb888b9 to
ca34d52
Compare
Contributor
Author
CI status updateThe SAST blocker has been resolved. Here's a summary of what was fixed: SAST - Semgrep OWASP Top 10: ✅ PASS 14 critical Semgrep findings fixedThe security scan was failing with 14 critical findings across files introduced by prior PRs. All have been addressed:
Remaining CI failures are pre-existingAll other failing checks (TypeScript Build/Lint/Tests, Rust Format/Clippy, Bundle Size, k6, NPM Audit, Detox, Code Coverage, Container Scanning, DAST) fail identically on |
Contributor
Author
PR status update — 2026-10-21This PR (#1842) is ready for reviewWhat this PR does: Pins the GitHub Actions tags in the CI summary
All failing checks fail identically on Wave issues resolvedThe four assigned Wave issues have all been implemented and submitted as separate PRs as noted in my earlier comment:
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves the Semgrep / GitHub Advanced Security findings flagged in PRs #1336, #1337, and #1338.
All three PRs that added the
build-metricsjob received the same two security alerts:actions/checkout@v7uses a mutable tagactions/setup-node@v4uses a mutable tagMutable tags can be silently repointed by the action owner, enabling supply-chain attacks (as seen in the trivy-action and kics-github-action compromises).
Changes
Pins the three actions used in the
build-metricsjob to their full 40-character commit SHAs:actions/checkout@v7→ v7.0.13d3c42e5aac5ba805825da76410c181273ba90b1pnpm/action-setup@v4→ v4.4.0fc06bc1257f339d1d5d8b3a19a8cae5388b55320actions/setup-node@v4→ v4.4.049933ea5288caeca8642d1e84afbd3f7d6820020No other jobs are modified. Pre-existing mutable tags in the rest of the workflow are a separate concern and out of scope for this targeted fix.
Testing
No functional change — the workflow behaviour is identical. The pinned SHAs resolve to the same releases as the mutable tags they replace.