chore: harden GitHub Actions supply chain security (#1365)

tejassp-db · web-flow · commit 4d763820c857 · 2026-03-28T11:29:05.000+05:30
## Summary A supply chain security audit of the dbt-databricks CI/CD pipeline identified **8 findings** across GitHub Actions workflows. This PR addresses the critical and medium severity issues: - **86% of GitHub Action references** used mutable tags (`@v4`, `@v5`) instead of immutable commit SHAs — an attacker who compromises an upstream action repo can silently change what code runs in CI, including jobs with access to Databricks secrets - **`pypa/hatch@install`** had zero version pinning (a branch ref, not even a tag) and ran in 6 jobs - **`conventional-commits-parser`** npm package was installed without any version constraint - **Dependabot config** was in the wrong directory (`.github/ISSUE_TEMPLATE/dependabot.yml`) and was completely inactive - **No lock file** — `uv.lock` was in `.gitignore`, making CI builds non-deterministic ## Changes ### 1. Pin all GitHub Actions to immutable commit SHAs - Replaced all 32 mutable tag references across `main.yml`, `integration.yml`, `ci-pr-linting.yml`, and `coverage.yml` with full 40-character commit SHAs - All SHAs verified via `gh api` to predate March 18, 2026 - `stale.yml` was already SHA-pinned — no change needed - Trailing comments preserve the original tag for readability (e.g., `actions/checkout@34e11487... # v4`) **SHA Reference:** | Action | SHA | Commit Date | |--------|-----|-------------| | `actions/checkout` | `34e11487...` | 2025-11-13 | | `actions/setup-python` | `a26af69b...` | 2025-04-24 | | `actions/setup-node` | `49933ea5...` | 2025-04-02 | | `actions/upload-artifact` | `ea165f8d...` | 2025-03-19 | | `astral-sh/setup-uv` | `38f3f104...` | 2024-11-30 | | `pypa/hatch` | `257e27e5...` | 2024-05-23 | | `py-cov-action/python-coverage-comment-action` | `7188638f...` | 2026-01-06 | ### 2. Pin conventional-commits-parser to v6.3.0 - npm versions are immutable (can't be republished with different content), so exact version pinning is sufficient - v6.3.0 published 2026-03-01 (before March 18 cutoff) - Note: Dependabot cannot auto-update this pin since it's an inline workflow install, not a `package.json` dependency — updates must be manual ### 3. Fix Dependabot config location and add github-actions ecosystem - Moved from `.github/ISSUE_TEMPLATE/dependabot.yml` (wrong — GitHub never reads this) to `.github/dependabot.yml` - Added `github-actions` ecosystem with weekly schedule so SHA-pinned actions get automatic update PRs - Kept `pip` ecosystem with daily schedule - No `npm` ecosystem — the npm dependency is an inline workflow install that Dependabot cannot track ### 4. Commit uv.lock and enforce frozen installs in CI - Removed `uv.lock` from `.gitignore` and committed the generated lock file (82 resolved packages) - Added `UV_FROZEN: "1"` environment variable to all 6 CI jobs (3 in `main.yml`, 3 in `integration.yml`) - When `UV_FROZEN=1` is set, uv refuses to install if the lock file doesn't match `pyproject.toml`, failing CI loudly instead of silently re-resolving - **Developer impact:** when changing dependencies in `pyproject.toml`, you must also run `uv lock` and commit the updated `uv.lock` ### 5. Enhance CODEOWNERS - Added `@jprakash-db` as a code owner - Added explicit `/.github/workflows/` rule to make CI security review governance explicit ## Files Modified | File | Change | |------|--------| | `.github/workflows/main.yml` | 14 action refs SHA-pinned, `UV_FROZEN: "1"` added to 3 jobs | | `.github/workflows/integration.yml` | 15 action refs SHA-pinned, `UV_FROZEN: "1"` added to 3 jobs | | `.github/workflows/ci-pr-linting.yml` | 2 action refs SHA-pinned, npm pinned to `@6.3.0` | | `.github/workflows/coverage.yml` | 1 action ref SHA-pinned | | `.github/ISSUE_TEMPLATE/dependabot.yml` | Deleted | | `.github/dependabot.yml` | Created (correct location) | | `.gitignore` | Removed `uv.lock` line | | `uv.lock` | Created (82 resolved packages) | | `.github/CODEOWNERS` | Added `@jprakash-db`, added workflow rule | ## Local Validation Results - **actionlint:** no new errors (only pre-existing warnings about `linux-ubuntu-latest` custom runner label) - **grep audit:** 0 unpinned action refs remaining - **SHA resolution:** all 7 SHAs verified via `gh api` - **All SHAs predate March 18, 2026** - **npm pin:** `conventional-commits-parser@6.3.0` installs and parses correctly - **Frozen mode:** env resolution, code-quality, and 719 unit tests all pass with `UV_FROZEN=1` - **Drift test:** frozen mode correctly fails when lock file is stale ## Test plan - [ ] CI workflows pass with SHA-pinned actions - [ ] `Check PR title format` workflow validates PR titles correctly with pinned npm package - [ ] Unit tests pass with `UV_FROZEN=1` and committed `uv.lock` - [ ] After merge: verify Dependabot activates (Security > Dependabot tab) for pip and github-actions ecosystems - [ ] After merge: verify correct reviewers are auto-requested on workflow file changes ## Audit Findings Addressed | # | Finding | Severity | Status | |---|---------|----------|--------| | 1 | `pypa/hatch@install` — no version constraint | HIGH | Fixed | | 2 | 19/22 GitHub Actions pinned to tags, not SHAs | MEDIUM | Fixed | | 3 | `npm install conventional-commits-parser` unpinned | MEDIUM | Fixed | | 4 | No `uv.lock` committed — non-deterministic CI | MEDIUM | Fixed | | 5 | Dependabot config in wrong directory | MEDIUM | Fixed | | 6 | 8/11 dev dependencies unpinned | LOW | Deferred (uv.lock covers this) | | 7 | Build verification tools unpinned | LOW | Deferred (uv.lock covers this) | | 8 | `contents: write` on unit test job | INFO | Acceptable — already scoped | --- JIRA: [PECOBLR-2368](https://databricks.atlassian.net/browse/PECOBLR-2368) This pull request was AI-assisted by Isaac. [PECOBLR-2368]: https://databricks.atlassian.net/browse/PECOBLR-2368?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
@@ -2,4 +2,7 @@
 # the repo. Unless a later match takes precedence, these
 # users will be requested for review when someone opens a
 # pull request.
-*       @sd-db @tejassp-db @benc-db
+*       @sd-db @tejassp-db @benc-db @jprakash-db
+
+# Explicit rule for CI/CD workflow changes
+/.github/workflows/ @sd-db @tejassp-db @benc-db @jprakash-db
diff --git a/.github/ISSUE_TEMPLATE/dependabot.yml b/.github/ISSUE_TEMPLATE/dependabot.yml
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,15 @@
+version: 2
+updates:
+  # Python dependencies
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    rebase-strategy: "disabled"
+
+  # GitHub Actions — auto-update SHA pins
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    rebase-strategy: "disabled"
diff --git a/.github/workflows/ci-pr-linting.yml b/.github/workflows/ci-pr-linting.yml
@@ -15,15 +15,15 @@ jobs:
   pr-title:
     runs-on: linux-ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
         with:
           node-version: 20
       - name: Install conventional commit parser
         shell: bash
-        run: npm install --global conventional-commits-parser
+        run: npm install --global conventional-commits-parser@6.3.0
 
       - name: Validate PR title
         id: pr-format
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
@@ -27,7 +27,7 @@ jobs:
       # DO NOT run actions/checkout here, for security reasons
       # For details, refer to https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
       - name: Post comment
-        uses: py-cov-action/python-coverage-comment-action@v3
+        uses: py-cov-action/python-coverage-comment-action@7188638f871f721a365d644f505d1ff3df20d683  # v3
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITHUB_PR_RUN_ID: ${{ github.event.workflow_run.id }}
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
@@ -52,9 +52,10 @@ jobs:
       DBT_DATABRICKS_UC_INITIAL_CATALOG: peco
       DBT_DATABRICKS_LOCATION_ROOT: ${{ secrets.TEST_PECO_EXTERNAL_LOCATION }}test
       TEST_PECO_UC_CLUSTER_ID: ${{ secrets.TEST_PECO_UC_CLUSTER_ID }}
+      UV_FROZEN: "1"
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
         with:
           # For pull_request: checkout the PR head commit
           # For workflow_dispatch with pr_number: checkout that PR's head
@@ -66,7 +67,7 @@ jobs:
 
       - name: Set up python
         id: setup-python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
         with:
           python-version: "3.10"
 
@@ -75,18 +76,18 @@ jobs:
         shell: sh
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a  # v4
 
       - name: Install Hatch
         id: install-dependencies
-        uses: pypa/hatch@install
+        uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc  # install
 
       - name: Run UC Cluster Functional Tests
         run: DBT_TEST_USER=notnecessaryformosttests@example.com DBT_DATABRICKS_LOCATION_ROOT=$DBT_DATABRICKS_LOCATION_ROOT DBT_DATABRICKS_HOST_NAME=$DBT_DATABRICKS_HOST_NAME DBT_DATABRICKS_UC_CLUSTER_HTTP_PATH=$DBT_DATABRICKS_UC_CLUSTER_HTTP_PATH DBT_DATABRICKS_CLIENT_ID=$DBT_DATABRICKS_CLIENT_ID DBT_DATABRICKS_CLIENT_SECRET=$DBT_DATABRICKS_CLIENT_SECRET hatch -v run uc-cluster-e2e
 
       - name: Upload UC Cluster Test Logs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         with:
           name: uc-cluster-test-logs
           path: logs/
@@ -105,9 +106,10 @@ jobs:
       DBT_DATABRICKS_UC_INITIAL_CATALOG: peco
       DBT_DATABRICKS_LOCATION_ROOT: ${{ secrets.TEST_PECO_EXTERNAL_LOCATION }}test
       TEST_PECO_UC_CLUSTER_ID: ${{ secrets.TEST_PECO_UC_CLUSTER_ID }}
+      UV_FROZEN: "1"
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
         with:
           # For pull_request: checkout the PR head commit
           # For workflow_dispatch with pr_number: checkout that PR's head
@@ -119,7 +121,7 @@ jobs:
 
       - name: Set up python
         id: setup-python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
         with:
           python-version: "3.10"
 
@@ -128,18 +130,18 @@ jobs:
         shell: sh
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a  # v4
 
       - name: Install Hatch
         id: install-dependencies
-        uses: pypa/hatch@install
+        uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc  # install
 
       - name: Run Sql Endpoint Functional Tests
         run: DBT_TEST_USER=notnecessaryformosttests@example.com DBT_DATABRICKS_LOCATION_ROOT=$DBT_DATABRICKS_LOCATION_ROOT DBT_DATABRICKS_HOST_NAME=$DBT_DATABRICKS_HOST_NAME DBT_DATABRICKS_UC_CLUSTER_HTTP_PATH=$DBT_DATABRICKS_UC_CLUSTER_HTTP_PATH DBT_DATABRICKS_CLIENT_ID=$DBT_DATABRICKS_CLIENT_ID DBT_DATABRICKS_CLIENT_SECRET=$DBT_DATABRICKS_CLIENT_SECRET hatch -v run sqlw-e2e
 
       - name: Upload SQL Endpoint Test Logs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         with:
           name: sql-endpoint-test-logs
           path: logs/
@@ -156,9 +158,10 @@ jobs:
       DBT_DATABRICKS_CLIENT_SECRET: ${{ secrets.TEST_PECO_SP_SECRET }}
       TEST_PECO_CLUSTER_ID: ${{ secrets.TEST_PECO_CLUSTER_ID }}
       DBT_DATABRICKS_LOCATION_ROOT: ${{ secrets.TEST_PECO_EXTERNAL_LOCATION }}test
+      UV_FROZEN: "1"
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
         with:
           # For pull_request: checkout the PR head commit
           # For workflow_dispatch with pr_number: checkout that PR's head
@@ -170,7 +173,7 @@ jobs:
 
       - name: Set up python
         id: setup-python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
         with:
           python-version: "3.10"
 
@@ -179,18 +182,18 @@ jobs:
         shell: sh
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a  # v4
 
       - name: Install Hatch
         id: install-dependencies
-        uses: pypa/hatch@install
+        uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc  # install
 
       - name: Run Cluster Functional Tests
         run: DBT_TEST_USER=notnecessaryformosttests@example.com DBT_DATABRICKS_LOCATION_ROOT=$DBT_DATABRICKS_LOCATION_ROOT DBT_DATABRICKS_HOST_NAME=$DBT_DATABRICKS_HOST_NAME DBT_DATABRICKS_HTTP_PATH=$DBT_DATABRICKS_CLUSTER_HTTP_PATH DBT_DATABRICKS_CLIENT_ID=$DBT_DATABRICKS_CLIENT_ID DBT_DATABRICKS_CLIENT_SECRET=$DBT_DATABRICKS_CLIENT_SECRET hatch -v run cluster-e2e
 
       - name: Upload Cluster Test Logs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         with:
           name: cluster-test-logs
           path: logs/
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -47,23 +47,26 @@ jobs:
     runs-on: linux-ubuntu-latest
     timeout-minutes: 10
 
+    env:
+      UV_FROZEN: "1"
+
     strategy:
       fail-fast: false
 
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
         with:
           python-version: "3.10"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a  # v4
 
       - name: Install Hatch
-        uses: pypa/hatch@install
+        uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc  # install
 
       - name: Run Code Quality
         run: hatch -v run code-quality
@@ -83,38 +86,41 @@ jobs:
       # comments (to avoid publishing multiple comments in the same PR)
       contents: write
 
+    env:
+      UV_FROZEN: "1"
+
     strategy:
       fail-fast: false
       matrix:
         python-version: ["3.10", "3.11", "3.12", "3.13"]
 
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
         with:
           python-version: ${{ matrix.python-version }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a  # v4
 
       - name: Install Hatch
-        uses: pypa/hatch@install
+        uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc  # install
 
       - name: Run Unit Tests and Generate Coverage
         run: hatch run -v +py=${{ matrix.python-version }} test:unit-with-cov
 
       # Only run coverage comment once (not for all python versions)
       - name: Coverage Comment
         if: matrix.python-version == '3.12' && github.event_name == 'pull_request'
-        uses: py-cov-action/python-coverage-comment-action@v3
+        uses: py-cov-action/python-coverage-comment-action@7188638f871f721a365d644f505d1ff3df20d683  # v3
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Store Pull Request comment to be posted
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         if: steps.coverage_comment.outputs.COMMENT_FILE_WRITTEN == 'true'
         with:
           name: python-coverage-comment-action
@@ -124,20 +130,23 @@ jobs:
     name: Build and Verify Packages
     runs-on: linux-ubuntu-latest
 
+    env:
+      UV_FROZEN: "1"
+
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
         with:
           python-version: "3.10"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a  # v4
 
       - name: Install Hatch
-        uses: pypa/hatch@install
+        uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc  # install
 
       - name: Build distributions
         run: hatch -v build
diff --git a/.gitignore b/.gitignore
@@ -24,5 +24,5 @@ logs/
 CLAUDE.md
 .claude/
 .cursor
-uv.lock
+
 docs/plans/
diff --git a/uv.lock b/uv.lock
