ci(audit): report unpinned workflow actions (#3379)

scripts/security/check_workflow_pins.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+mode="report"
+if [[ "${1:-}" == "--enforce" ]]; then
+  mode="enforce"
+fi
+
+if [[ "${1:-}" != "" && "${1:-}" != "--enforce" ]]; then
+  echo "usage: $0 [--enforce]" >&2
+  exit 2
+fi
+
+trim() {
+  local value="$1"
+  value="${value#"${value%%[![:space:]]*}"}"
+  value="${value%"${value##*[![:space:]]}"}"
+  printf '%s' "$value"
+}
+
+report_unpinned() {
+  local file="$1"
+  local line_no="$2"
+  local action_ref="$3"
+  local reason="$4"
+
+  printf '%s:%s: %s (%s)\n' "$file" "$line_no" "$action_ref" "$reason"
+
+  if [[ -n "${GITHUB_ACTIONS:-}" ]]; then
+    printf '::warning file=%s,line=%s::Unpinned third-party action %s (%s)\n' \
+      "$file" "$line_no" "$action_ref" "$reason"
+  fi
+}
+
+files=()
+while IFS= read -r -d '' file; do
+  files+=("$file")
+done < <(find .github/workflows .github/actions -type f \( -name '*.yml' -o -name '*.yaml' \) -print0 2>/dev/null | sort -z)
+
+unpinned=0
+for file in "${files[@]}"; do
+  line_no=0
+  while IFS= read -r line || [[ -n "$line" ]]; do
+    line_no=$((line_no + 1))
+    stripped="$(trim "$line")"
+
+    [[ -z "$stripped" || "$stripped" == \#* ]] && continue
+
+    if [[ "$stripped" =~ ^-?[[:space:]]*uses:[[:space:]]*(.+)$ ]]; then
+      action_ref="$(trim "${BASH_REMATCH[1]}")"
+      action_ref="$(trim "${action_ref%% #*}")"
+      action_ref="${action_ref%\"}"
+      action_ref="${action_ref#\"}"
+      action_ref="${action_ref%\'}"
+      action_ref="${action_ref#\'}"
+
+      [[ -z "$action_ref" ]] && continue
+      [[ "$action_ref" == ./* ]] && continue
+      [[ "$action_ref" == docker://* ]] && continue
+
+      if [[ "$action_ref" != *@* ]]; then
+        report_unpinned "$file" "$line_no" "$action_ref" "missing @ref"
+        unpinned=$((unpinned + 1))
+        continue
+      fi
+
+      ref="${action_ref##*@}"
+      if [[ ! "$ref" =~ ^[0-9a-fA-F]{40}$ ]]; then
+        report_unpinned "$file" "$line_no" "$action_ref" "ref is not a full-length commit SHA"
+        unpinned=$((unpinned + 1))
+      fi
+    fi
+  done < "$file"
+done
+
+if [[ "$unpinned" -eq 0 ]]; then
+  echo "All third-party GitHub Actions are pinned to full-length commit SHAs."
+  exit 0
+fi
+
+echo "Found $unpinned unpinned third-party GitHub Action reference(s)."
+
+if [[ "$mode" == "enforce" ]]; then
+  exit 1
+fi
+
+echo "Report-only mode; rerun with --enforce after existing refs are pinned."