Harden GitHub Actions Workflow - create-release.yml





## Summary

This issue is created by [StepSecurity](https://docs.stepsecurity.io) related to security issues in [ create-release.yml ]( https://github.com/TLMSLLC/ton-6950ea4e/blob/master/.github/workflows/create-release.yml ). The platform has identified **2 vulnerabilities** (1 critical, 0 high, 0 medium, 1 low).



### Remediation Overview
The platform can generate remediations for a few vulnerabilities. For such vulnerabilities, you can find the fixed workflow file in the `Suggested Fix For Auto-Remediable Issues` section. You can manually deploy these changes or create a pull request by commenting `@stepsecurity-app pull-request create` on this issue.
> If you’d like an automated pull request with the fixed workflow file, comment:  
>  
> ```bash
> @stepsecurity-app pull-request create
> ```  

Other issues require manual investigation and changes. 

Once a vulnerability has been remediated, ✅ will appear in the title. Note that it may take up to 24 hours for these issues to be updated.

Please review the individual vulnerability section below and follow the recommended resolution steps.


### Security Checks Details


### ❌ Actions should be pinned to a full-length commit SHA
- **Severity**: Critical
- **Description**: GitHub Action tags and Docker tags are mutable. This poses a security risk. GitHub's Security Hardening guide recommends pinning actions to full length commit.
- **Resolution:** Pin Actions to a full-length commit SHA..
- **Automated Remediation Available ?:** true
- **References:** 

  - [ GitHub Security Guide ](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions)

  - [ The Open Source Security Foundation (OpenSSF) Security Guide ](https://github.com/ossf/scorecard/blob/main/docs/checks.md#actions-pinned)


### ❌ Network and runtime security monitoring should be enabled for GitHub-hosted runners
- **Severity**: Low
- **Description**: This check passes if the step-security/harden-runner GitHub Action is used in a job that runs on a GitHub-hosted runner. Harden-Runner prevents exfiltration of code and CI/CD credentials, and detects tampering of files during build.
- **Resolution:** Add the step-security/harden-runner GitHub Action to the job.
- **Automated Remediation Available ?:** true
- **References:** 

  - [ GitHub Security Guide ](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#using-the-github_token-in-a-workflow)

  - [ The Open Source Security Foundation (OpenSSF) Security Guide ](https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions)





### Suggested Fix For Auto-Remediable Issues

Below is the updated workflow, which fixes the following security vulnerabilities:



- Actions should be pinned to a full-length commit SHA



- Network and runtime security monitoring should be enabled for GitHub-hosted runners


```diff
  name: Create release
  on: [workflow_dispatch]
  permissions: write-all
  env:
    GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  jobs:
    create-release:
      runs-on: ubuntu-22.04
      steps:
        - 
+ name: Harden the runner (Audit all outbound calls)
+         uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+         with:
+           egress-policy: audit
+       - 
  uses: actions/checkout@
+ a37ce9120846195fa4ece8f58b268e6043cb2f26 # 
  v3
+ .7.0
        - name: Download Linux arm64 artifacts
          uses: dawidd6/action-download-artifact@
+ bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # 
  v6
          with:
            workflow: build-ton-linux-arm64-appimage.yml
            path: artifacts
            workflow_conclusion: success
            branch: master
            skip_unpack: true
        - name: Download and unzip Linux arm64 artifacts
          uses: dawidd6/action-download-artifact@
+ bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # 
  v6
          with:
            workflow: build-ton-linux-arm64-appimage.yml
            path: artifacts
            workflow_conclusion: success
            branch: master
            skip_unpack: false
        - name: Download Linux x86-64 artifacts
          uses: dawidd6/action-download-artifact@
+ bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # 
  v6
          with:
            workflow: build-ton-linux-x86-64-appimage.yml
            path: artifacts
            workflow_conclusion: success
            branch: master
            skip_unpack: true
        - name: Download and unzip Linux x86-64 artifacts
          uses: dawidd6/action-download-artifact@
+ bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # 
  v6
          with:
            workflow: build-ton-linux-x86-64-appimage.yml
            path: artifacts
            workflow_conclusion: success
            branch: master
            skip_unpack: false
        - name: Download Mac x86-64 artifacts
          uses: dawidd6/action-download-artifact@
+ bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # 
  v6
          with:
            workflow: build-ton-macos-15-x86-64-portable.yml
            path: artifacts
            workflow_conclusion: success
            branch: master
            skip_unpack: true
        - name: Download Mac arm64 artifacts
          uses: dawidd6/action-download-artifact@
+ bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # 
  v6
          with:
            workflow: build-ton-macos-14-arm64-portable.yml
            path: artifacts
            workflow_conclusion: success
            branch: master
            skip_unpack: true
        - name: Download and unzip Mac x86-64 artifacts
          uses: dawidd6/action-download-artifact@
+ bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # 
  v6
          with:
            workflow: build-ton-macos-15-x86-64-portable.yml
            path: artifacts
            workflow_conclusion: success
            branch: master
            skip_unpack: false
        - name: Download and unzip arm64 artifacts
          uses: dawidd6/action-download-artifact@
+ bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # 
  v6
          with:
            workflow: build-ton-macos-14-arm64-portable.yml
            path: artifacts
            workflow_conclusion: success
            branch: master
            skip_unpack: false
        - name: Download Windows artifacts
          uses: dawidd6/action-download-artifact@
+ bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # 
  v6
          with:
            workflow: ton-x86-64-windows.yml
            path: artifacts
            workflow_conclusion: success
            branch: master
            skip_unpack: true
        - name: Download and unzip Windows artifacts
          uses: dawidd6/action-download-artifact@
+ bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # 
  v6
          with:
            workflow: ton-x86-64-windows.yml
            path: artifacts
            workflow_conclusion: success
            branch: master
            skip_unpack: false
        - name: Download WASM artifacts
          uses: dawidd6/action-download-artifact@
+ bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # 
  v6
          with:
            workflow: build-ton-wasm-emscripten.yml
            path: artifacts
            workflow_conclusion: success
            branch: master
            skip_unpack: true
        - name: Download Android Tonlib artifacts
          uses: dawidd6/action-download-artifact@
+ bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # 
  v6
          with:
            workflow: build-ton-linux-android-tonlib.yml
            path: artifacts
            workflow_conclusion: success
            branch: master
            skip_unpack: true
        - name: Show all artifacts
          run: |
            tree artifacts
        # create release
        - name: Read Changelog.md and use it as a body of new release
          id: read_release
          shell: bash
          run: |
            r=$(cat recent_changelog.md)
            r="${r//'%'/'%25'}"
            r="${r//$'\n'/'%0A'}"
            r="${r//$'\r'/'%0D'}"
            echo "::set-output name=CHANGELOG_BODY::$r"
        - name: Get next tag
          id: tag
          run: |
            git fetch --all --tags
            git tag -l
            NEW_TAG=v$(date +'%Y.%m')
            FOUND=$(git tag -l | grep $NEW_TAG | wc -l)
            if [ $FOUND -eq 0 ]; then
              echo "TAG=$NEW_TAG" >> $GITHUB_OUTPUT
            else
              echo "TAG=$NEW_TAG-$FOUND" >> $GITHUB_OUTPUT
            fi
        - name: Get registration token
          id: getRegToken
          run: |
            curl -X POST -H \"Accept: application/vnd.github+json\"  -H 'Authorization: token ${{ secrets.GITHUB_TOKEN }}' https://api.github.com/repos/ton-blockchain/ton/actions/runners/registration-token
        - name: Create release
          id: create_release
          uses: actions/create-release@
+ 0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # 
  v1
+ .1.4
          env:
            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          with:
            tag_name: ${{ steps.tag.outputs.TAG }}
            release_name: TON ${{ steps.tag.outputs.TAG }}
            body: |
              ${{ steps.read_release.outputs.CHANGELOG_BODY }}
            draft: false
            prerelease: false
        # upload
        # win
        - name: Upload Windows 2019 artifacts
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86-64-windows.zip
            asset_name: ton-win-x86-64.zip
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Windows 2019 single artifact - fift
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86-64-windows/fift.exe
            asset_name: fift.exe
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Windows 2019 single artifact - func
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86-64-windows/func.exe
            asset_name: func.exe
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Windows 2019 single artifact - tolk
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86-64-windows/tolk.exe
            asset_name: tolk.exe
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Windows 2019 single artifact - lite-client
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86-64-windows/lite-client.exe
            asset_name: lite-client.exe
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Windows 2019 single artifact - proxy-liteserver
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86-64-windows/proxy-liteserver.exe
            asset_name: proxy-liteserver.exe
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Windows 2019 single artifact - rldp-http-proxy
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86-64-windows/rldp-http-proxy.exe
            asset_name: rldp-http-proxy.exe
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Windows 2019 single artifact - http-proxy
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86-64-windows/http-proxy.exe
            asset_name: http-proxy.exe
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Windows 2019 single artifact - storage-daemon-cli
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86-64-windows/storage-daemon-cli.exe
            asset_name: storage-daemon-cli.exe
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Windows 2019 single artifact - storage-daemon
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86-64-windows/storage-daemon.exe
            asset_name: storage-daemon.exe
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Windows 2019 single artifact - tonlibjson
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86-64-windows/tonlibjson.dll
            asset_name: tonlibjson.dll
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Windows 2019 single artifact - libemulator
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86-64-windows/emulator.dll
            asset_name: libemulator.dll
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Windows 2019 single artifact - tonlib-cli
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86-64-windows/tonlib-cli.exe
            asset_name: tonlib-cli.exe
            tag: ${{ steps.tag.outputs.TAG }}
        # mac x86-64
        - name: Upload Mac x86-64 artifacts
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86_64-macos.zip
            asset_name: ton-mac-x86-64.zip
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Mac x86-64 single artifact - fift
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86_64-macos/fift
            asset_name: fift-mac-x86-64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Mac x86-64 single artifact - func
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86_64-macos/func
            asset_name: func-mac-x86-64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Mac x86-64 single artifact - tolk
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86_64-macos/tolk
            asset_name: tolk-mac-x86-64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Mac x86-64 single artifact - lite-client
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86_64-macos/lite-client
            asset_name: lite-client-mac-x86-64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Mac x86-64 single artifact - proxy-liteserver
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86_64-macos/proxy-liteserver
            asset_name: proxy-liteserver-mac-x86-64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Mac x86-64 single artifact - rldp-http-proxy
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86_64-macos/rldp-http-proxy
            asset_name: rldp-http-proxy-mac-x86-64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Mac x86-64 single artifact - http-proxy
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86_64-macos/http-proxy
            asset_name: http-proxy-mac-x86-64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Mac x86-64 single artifact - storage-daemon-cli
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86_64-macos/storage-daemon-cli
            asset_name: storage-daemon-cli-mac-x86-64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Mac x86-64 single artifact - storage-daemon
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86_64-macos/storage-daemon
            asset_name: storage-daemon-mac-x86-64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Mac x86-64 single artifact - tonlibjson
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86_64-macos/libtonlibjson.dylib
            asset_name: tonlibjson-mac-x86-64.dylib
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Mac x86-64 single artifact - libemulator
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86_64-macos/libemulator.dylib
            asset_name: libemulator-mac-x86-64.dylib
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Mac x86-64 single artifact - tonlib-cli
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86_64-macos/tonlib-cli
            asset_name: tonlib-cli-mac-x86-64
            tag: ${{ steps.tag.outputs.TAG }}
        # mac arm64
        - name: Upload Mac arm64 artifacts
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-arm64-macos.zip
            asset_name: ton-mac-arm64.zip
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Mac arm64 single artifact - fift
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-arm64-macos/fift
            asset_name: fift-mac-arm64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Mac arm64 single artifact - func
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-arm64-macos/func
            asset_name: func-mac-arm64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Mac arm64 single artifact - tolk
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-arm64-macos/tolk
            asset_name: tolk-mac-arm64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Mac arm64 single artifact - lite-client
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-arm64-macos/lite-client
            asset_name: lite-client-mac-arm64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Mac arm64 single artifact - proxy-liteserver
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-arm64-macos/proxy-liteserver
            asset_name: proxy-liteserver-mac-arm64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Mac arm64 single artifact - rldp-http-proxy
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-arm64-macos/rldp-http-proxy
            asset_name: rldp-http-proxy-mac-arm64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Mac arm64 single artifact - http-proxy
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-arm64-macos/http-proxy
            asset_name: http-proxy-mac-arm64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Mac arm64 single artifact - storage-daemon-cli
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-arm64-macos/storage-daemon-cli
            asset_name: storage-daemon-cli-mac-arm64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Mac arm64 single artifact - storage-daemon
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-arm64-macos/storage-daemon
            asset_name: storage-daemon-mac-arm64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Mac arm64 single artifact - tonlibjson
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-arm64-macos/libtonlibjson.dylib
            asset_name: tonlibjson-mac-arm64.dylib
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Mac arm64 single artifact - libemulator
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-arm64-macos/libemulator.dylib
            asset_name: libemulator-mac-arm64.dylib
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Mac arm64 single artifact - tonlib-cli
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-arm64-macos/tonlib-cli
            asset_name: tonlib-cli-mac-arm64
            tag: ${{ steps.tag.outputs.TAG }}
        # linux x86-64
        - name: Upload Linux x86-64 artifacts
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86_64-linux.zip
            asset_name: ton-linux-x86_64.zip
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload generic smartcont+lib artifact
          run: |
            mkdir smartcont_lib
            cd smartcont_lib
            cp -r ../artifacts/ton-x86_64-linux/{smartcont,lib} .          
            zip -r smartcont_lib.zip .
            gh release upload ${{ steps.tag.outputs.TAG }} smartcont_lib.zip
        - name: Upload Linux x86-64 single artifact - fift
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86_64-linux/fift
            asset_name: fift-linux-x86_64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Linux x86-64 single artifact - func
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86_64-linux/func
            asset_name: func-linux-x86_64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Linux x86-64 single artifact - tolk
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86_64-linux/tolk
            asset_name: tolk-linux-x86_64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Linux x86-64 single artifact - lite-client
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86_64-linux/lite-client
            asset_name: lite-client-linux-x86_64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Linux x86-64 single artifact - proxy-liteserver
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86_64-linux/proxy-liteserver
            asset_name: proxy-liteserver-linux-x86_64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Linux x86-64 single artifact - rldp-http-proxy
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86_64-linux/rldp-http-proxy
            asset_name: rldp-http-proxy-linux-x86_64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Linux x86-64 single artifact - http-proxy
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86_64-linux/http-proxy
            asset_name: http-proxy-linux-x86_64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Linux x86-64 single artifact - storage-daemon-cli
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86_64-linux/storage-daemon-cli
            asset_name: storage-daemon-cli-linux-x86_64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Linux x86-64 single artifact - storage-daemon
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86_64-linux/storage-daemon
            asset_name: storage-daemon-linux-x86_64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Linux x86-64 single artifact - tonlibjson
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86_64-linux/libtonlibjson.so
            asset_name: tonlibjson-linux-x86_64.so
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Linux x86-64 single artifact - libemulator
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86_64-linux/libemulator.so
            asset_name: libemulator-linux-x86_64.so
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Linux x86-64 single artifact - tonlib-cli
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-x86_64-linux/tonlib-cli
            asset_name: tonlib-cli-linux-x86_64
            tag: ${{ steps.tag.outputs.TAG }}
        # linux arm64
        - name: Upload Linux arm64 artifacts
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-arm64-linux.zip
            asset_name: ton-linux-arm64.zip
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Linux arm64 single artifact - fift
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-arm64-linux/fift
            asset_name: fift-linux-arm64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Linux arm64 single artifact - func
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-arm64-linux/func
            asset_name: func-linux-arm64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Linux arm64 single artifact - tolk
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-arm64-linux/tolk
            asset_name: tolk-linux-arm64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Linux arm64 single artifact - lite-client
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-arm64-linux/lite-client
            asset_name: lite-client-linux-arm64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Linux arm64 single artifact - proxy-liteserver
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-arm64-linux/proxy-liteserver
            asset_name: proxy-liteserver-linux-arm64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Linux arm64 single artifact - rldp-http-proxy
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-arm64-linux/rldp-http-proxy
            asset_name: rldp-http-proxy-linux-arm64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Linux arm64 single artifact - http-proxy
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-arm64-linux/http-proxy
            asset_name: http-proxy-linux-arm64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Linux arm64 single artifact - storage-daemon-cli
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-arm64-linux/storage-daemon-cli
            asset_name: storage-daemon-cli-linux-arm64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Linux arm64 single artifact - storage-daemon
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-arm64-linux/storage-daemon
            asset_name: storage-daemon-linux-arm64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Linux arm64 single artifact - tonlibjson
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-arm64-linux/libtonlibjson.so
            asset_name: tonlibjson-linux-arm64.so
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Linux arm64 single artifact - libemulator
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-arm64-linux/libemulator.so
            asset_name: libemulator-linux-arm64.so
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Linux arm64 single artifact - tonlib-cli
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-arm64-linux/tonlib-cli
            asset_name: tonlib-cli-linux-arm64
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload WASM artifacts
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-wasm.zip
            asset_name: ton-wasm.zip
            tag: ${{ steps.tag.outputs.TAG }}
        - name: Upload Android Tonlib artifacts
          uses: svenstaro/upload-release-action@
+ 29e53e917877a24fad85510ded594ab3c9ca12de # 
  v2
          with:
            repo_token: ${{ secrets.GITHUB_TOKEN }}
            file: artifacts/ton-android-tonlib.zip
            asset_name: ton-android-tonlib.zip
            tag: ${{ steps.tag.outputs.TAG }}
```





## Additional Information

For more information, refer to the documentation page [here](https://docs.stepsecurity.io).
Please don't make any changes in the description as the platform makes automated updates in description. Please use the comment section below to provide input.

<details>
<summary>Automated remediation commands and options</summary>

- Create a pull request with automated security fixes
```bash
@stepsecurity-app pull-request create
```
- Close this issue and prevent it from being reopened
```bash
@stepsecurity-app issue close <REASON>
```
- Update issue description with latest security check status
```bash
@stepsecurity-app issue force-update
```
- View all available commands and their usage
```bash
@stepsecurity-app help
```

</details>

<details>
<summary>Which GitHub Actions security best practices were evaluated?</summary>

The workflow was evaluated for the following GitHub Actions security best practices:
- Network & runtime security monitoring  
- Token permissions
- Third‐party GitHub Actions usage & pinning

</details>


















Navigation Menu

Uh oh!

Harden GitHub Actions Workflow - create-release.yml #70

Summary

Remediation Overview

Security Checks Details

❌ Actions should be pinned to a full-length commit SHA

❌ Network and runtime security monitoring should be enabled for GitHub-hosted runners

Suggested Fix For Auto-Remediable Issues

Additional Information

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Uh oh!

Harden GitHub Actions Workflow - create-release.yml #70

Description

Summary

Remediation Overview

Security Checks Details

❌ Actions should be pinned to a full-length commit SHA

❌ Network and runtime security monitoring should be enabled for GitHub-hosted runners

Suggested Fix For Auto-Remediable Issues

Additional Information

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions