fix(ci): require immutable GitHub Action refs (#111)

Author: alxxjohn

internal/codeguard/checks/ci/ci_delivery_safety.go

@@ -11,9 +11,10 @@ import (
 )
 
 var (
-	workflowUsesPattern   = regexp.MustCompile(`(?i)\buses:\s*['"]?([^@\s'"]+)(?:@([^\s#'"]+))?`)
-	latestImagePattern    = regexp.MustCompile(`(?i)\b(?:image:|from)\s+['"]?[^@\s'"]+:latest\b`)
-	deployImageRunPattern = regexp.MustCompile(`(?i)\b(?:docker|kubectl|helm)\b.*:latest\b`)
+	workflowUsesPattern       = regexp.MustCompile(`(?i)\buses:\s*['"]?([^@\s'"]+)(?:@([^\s#'"]+))?`)
+	immutableActionRefPattern = regexp.MustCompile(`(?i)^[0-9a-f]{40}$`)
+	latestImagePattern        = regexp.MustCompile(`(?i)\b(?:image:|from)\s+['"]?[^@\s'"]+:latest\b`)
+	deployImageRunPattern     = regexp.MustCompile(`(?i)\b(?:docker|kubectl|helm)\b.*:latest\b`)
 )
 
 func missingRequiredGateFindings(env support.Context, target core.TargetConfig) []core.Finding {
@@ -152,12 +153,7 @@ func latestImageFinding(env support.Context, rel string, lineNo int, line string
 }
 
 func isMutableActionRef(ref string) bool {
-	normalized := strings.ToLower(strings.TrimSpace(ref))
-	switch normalized {
-	case "", "head", "latest", "main", "master", "develop", "development", "dev", "trunk", "stable":
-		return true
-	}
-	return strings.HasPrefix(normalized, "refs/heads/")
+	return !immutableActionRefPattern.MatchString(strings.TrimSpace(ref))
 }
 
 type ciFile struct {

internal/codeguard/rules/catalog_misc.go

@@ -92,7 +92,7 @@ var miscCatalog = map[string]core.RuleMetadata{
 		ExecutionModel:   core.RuleExecutionModelLanguageAgnostic,
 		LanguageCoverage: core.RepositoryWideRuleLanguageCoverage(),
 		Title:            "Mutable deployment reference",
-		Description:      "Fails when deployment automation uses a mutable GitHub Action branch ref or a container image tagged latest.",
+		Description:      "Fails when deployment automation uses a GitHub Action ref other than a full commit SHA or a container image tagged latest.",
 		HowToFix:         "Pin external actions to an immutable reviewed ref and replace latest image tags with versioned tags or digests.",
 	},
 	"ci.test-file-location": {

tests/checks/ci_test.go

@@ -111,7 +111,7 @@ func TestCIMutableDeploymentReference(t *testing.T) {
 	assertFindingRulePresent(t, report, "CI/CD", "ci.mutable-deployment-reference")
 }
 
-func TestCIMutableDeploymentReferenceAllowsVersionedRefs(t *testing.T) {
+func TestCIMutableDeploymentReferenceRejectsVersionedRefs(t *testing.T) {
 	dir := t.TempDir()
 	writeFile(t, filepath.Join(dir, ".github", "workflows", "deploy.yml"), "name: deploy\njobs:\n  prod:\n    steps:\n      - uses: actions/checkout@v4\n      - run: docker run ghcr.io/acme/service:v1.2.3\n")
 
@@ -123,6 +123,21 @@ func TestCIMutableDeploymentReferenceAllowsVersionedRefs(t *testing.T) {
 		t.Fatalf("run: %v", err)
 	}
 
+	assertFindingRulePresent(t, report, "CI/CD", "ci.mutable-deployment-reference")
+}
+
+func TestCIMutableDeploymentReferenceAllowsCommitSHA(t *testing.T) {
+	dir := t.TempDir()
+	writeFile(t, filepath.Join(dir, ".github", "workflows", "deploy.yml"), "name: deploy\njobs:\n  prod:\n    steps:\n      - uses: actions/checkout@8f3c2b1a4d5e6f7890abc1234567890abc123456\n")
+
+	cfg := ciSafetyTestConfig(dir, "ci-immutable-ref")
+	cfg.Checks.CIRules.RequiredWorkflowFiles = []string{".github/workflows/deploy.yml"}
+
+	report, err := codeguard.Run(context.Background(), cfg)
+	if err != nil {
+		t.Fatalf("run: %v", err)
+	}
+
 	if messages := ciRuleMessages(report, "ci.mutable-deployment-reference"); len(messages) != 0 {
 		t.Fatalf("unexpected mutable reference findings: %v", messages)
 	}