Harden GitHub Actions Workflow - build-ton-linux-arm64-appimage.yml

[stepsecurity-app]

Summary

This issue is created by StepSecurity related to security issues in build-ton-linux-arm64-appimage.yml . The platform has identified 1 vulnerability (1 critical, 0 high, 0 medium, 0 low).

Remediation Overview

The platform can generate remediations for a few vulnerabilities. For such vulnerabilities, you can find the fixed workflow file in the Suggested Fix For Auto-Remediable Issues section. You can manually deploy these changes or create a pull request by commenting @stepsecurity-app pull-request create on this issue.

If you’d like an automated pull request with the fixed workflow file, comment:

@stepsecurity-app pull-request create

Other issues require manual investigation and changes.

Once a vulnerability has been remediated, ✅ will appear in the title. Note that it may take up to 24 hours for these issues to be updated.

Please review the individual vulnerability section below and follow the recommended resolution steps.

Security Checks Details

❌ Actions should be pinned to a full-length commit SHA

• Severity: Critical

• Description: GitHub Action tags and Docker tags are mutable. This poses a security risk. GitHub's Security Hardening guide recommends pinning actions to full length commit.

• Resolution: Pin Actions to a full-length commit SHA..

• Automated Remediation Available ?: true

• References:

  • GitHub Security Guide

  • The Open Source Security Foundation (OpenSSF) Security Guide

Suggested Fix For Auto-Remediable Issues

Below is the updated workflow, which fixes the following security vulnerabilities:

• Actions should be pinned to a full-length commit SHA

  name: Ubuntu TON build (AppImages, arm64)
  on: [push, pull_request, workflow_dispatch, workflow_call]
  permissions:
    contents: read
  jobs:
    build:
      runs-on: ubuntu-22.04-arm
      steps:
      - name: Check out repository
        uses: actions/checkout@
+ a37ce9120846195fa4ece8f58b268e6043cb2f26 # 
  v3
+ .7.0
        with:
          submodules: 'recursive'
      - name: Date Stamp
        shell: bash
        id: date-stamp
        run: |
          echo "timestamp=$(date -u "+%Y%m%d%H%M_%S")" >> "$GITHUB_OUTPUT"
      - name: Install system libraries
        run: |
          sudo apt update
          sudo apt install -y build-essential git cmake ninja-build zlib1g-dev libsecp256k1-dev libmicrohttpd-dev libsodium-dev liblz4-dev ccache libgsl-dev libblas-dev libgslcblas0
          mkdir ~/.ccache 3pp
      - name: Install clang-16
        run: |
          lsb_release -a
          wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo apt-key add -
          echo "deb http://apt.llvm.org/jammy/ llvm-toolchain-jammy-16 main" | sudo tee /etc/apt/sources.list.d/llvm.list
          sudo apt-get -y update
          sudo apt-get install -y clang-16
      - name: Cache 3pp
        id: cache-3pp
        uses: actions/cache@
+ 0057852bfaa89a56745cba8c7296529d2fc39830 # 
  v4
+ .3.0
        with:
          path: 3pp
          key: ${{ runner.os }}-${{ runner.arch }}-ubuntu-22.04-arm-3pp-${{ hashFiles('**/assembly/native/build-ubuntu-appimages.sh') }}
      - name: Cache OpenSSL
        id: cache-openssl
        uses: actions/cache@
+ 0057852bfaa89a56745cba8c7296529d2fc39830 # 
  v4
+ .3.0
        with:
          path: openssl_3
          key: ${{ runner.os }}-${{ runner.arch }}-ubuntu-22.04-arm-openssl_3-${{ hashFiles('**/assembly/native/build-ubuntu-appimages.sh') }}
      - name: Restore cache TON
        uses: actions/cache/restore@
+ 0057852bfaa89a56745cba8c7296529d2fc39830 # 
  v4
+ .3.0
        with:
          path: ~/.ccache
          key: ${{ runner.os }}-${{ runner.arch }}-ubuntu-22.04-arm-portable-ccache-${{ steps.date-stamp.outputs.timestamp }}
          restore-keys: ${{ runner.os }}-${{ runner.arch }}-ubuntu-22.04-arm-portable-ccache
      - name: Build TON
        run: |
          git submodule sync --recursive
          git submodule update
          cp assembly/native/build-ubuntu-appimages.sh .
          chmod +x build-ubuntu-appimages.sh
          ./build-ubuntu-appimages.sh -a -c
          ccache -sp
      - name: Save cache TON
        uses: actions/cache/save@
+ 0057852bfaa89a56745cba8c7296529d2fc39830 # 
  v4
+ .3.0
        with:
          path: ~/.ccache
          key: ${{ runner.os }}-${{ runner.arch }}-ubuntu-22.04-arm-portable-ccache-${{ steps.date-stamp.outputs.timestamp }}
      - name: Make AppImages
        run: |
          cp assembly/appimage/create-appimages.sh .
          cp assembly/appimage/AppRun .
          cp assembly/appimage/ton.png .
          chmod +x create-appimages.sh
          ./create-appimages.sh aarch64
          rm -rf artifacts
      - name: Save/Restore cache TON libs
        uses: actions/cache@
+ 0057852bfaa89a56745cba8c7296529d2fc39830 # 
  v4
+ .3.0
        with:
          path: ~/.ccache
          key: ${{ runner.os }}-${{ runner.arch }}-ubuntu-22.04-arm-portable-libs-ccache-${{ steps.date-stamp.outputs.timestamp }}
          restore-keys: ${{ runner.os }}-${{ runner.arch }}-ubuntu-22.04-arm-portable-libs-ccache
      - name: Build TON libs
        run: |
          cp assembly/native/build-ubuntu-portable-libs.sh .
          chmod +x build-ubuntu-portable-libs.sh
          ./build-ubuntu-portable-libs.sh -a -c
          cp ./artifacts/libtonlibjson.so appimages/artifacts/
          cp ./artifacts/libemulator.so appimages/artifacts/
      - name: Upload artifacts
        uses: actions/upload-artifact@
+ 0c366cb4fc8897159c94880f94b55bc716ad6a66 # 
  master
        with:
          name: ton-arm64-linux
          path: appimages/artifacts

Additional Information

For more information, refer to the documentation page here.
Please don't make any changes in the description as the platform makes automated updates in description. Please use the comment section below to provide input.

Automated remediation commands and options

• Create a pull request with automated security fixes

@stepsecurity-app pull-request create

• Close this issue and prevent it from being reopened

@stepsecurity-app issue close <REASON>

• Update issue description with latest security check status

@stepsecurity-app issue force-update

• View all available commands and their usage

@stepsecurity-app help

Which GitHub Actions security best practices were evaluated?

The workflow was evaluated for the following GitHub Actions security best practices:

• Network & runtime security monitoring
• Token permissions
• Third‐party GitHub Actions usage & pinning