Zennoxa Shield
Rules / CI/CD
SHIELD-CI-001

GitHub Actions dependency pinned to a mutable tag

highCI/CDCWE-1357CVSS 8.1

What it detects

Referencing a GitHub Action by a mutable tag (e.g. @v4) or branch instead of a full commit SHA lets whoever controls that tag run arbitrary code on the runner. A repointed or compromised tag becomes remote code execution in CI — the tj-actions/changed-files and reviewdog compromises worked this way. Highest risk on self-hosted runners with write/deploy credentials.

How to fix

Pin actions to a full 40-character commit SHA (uses: owner/repo@<sha>) and note the version in a trailing comment. Enable Dependabot for action SHAs.

Vulnerable — Shield flags this.github/workflows/ci.yml
name: CI
on: [push]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - run: npm ci && npm test
Fixed — scans clean.github/workflows/ci.yml
name: CI
on: [push]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
        with:
          node-version: 20
      - run: npm ci && npm test

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CI-001, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-CI-001: GitHub Actions dependency pinned to a mutable tag — Zennoxa Shield