Forked Action security broken when Action uses a remote image (container job)?

[ThijsBroersen]

Select Topic Area

Question

Body

A common security practice on using 3rd party actions is to fork them and use only your own forks. But when this action uses a container to run its job (- uses: docker://ghcr.io/$owner/$name:$tag), then this fork doesn't add much value as this image is harder to inspect and could potentially be overwritten.

E.g. this action repo made a switch to use a publish version of the previously inline build Dockerfile: repo-sync/pull-request#110

[airtower-luna]

That is correct, and generally applies to any use of an image by tag rather than hash. There are other similar cases, e.g. a composite action using other actions by a ref. Even if you pin the composite action to a commit (or fork it) the actions it calls could be changed.

[ThijsBroersen]

The action maintainer could also use a hash in the image ref I assume? Then forking would still be safe as long as this image created process is transparent.

[airtower-luna]

Yeah. Both for a commit and for a container image using a hash means the data can't be changed without the hash changing, so you're sure what you get. You don't even need a fork that way, unless you're worried about the repository (or image) getting deleted.

But if the fixed data in a commit references something non-fixed (like you pointed out) you're back to the same problem.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬