Build pinning

build-pinningDeterministic

Base images are pinned by digest, CI actions are pinned by commit, and the CI declared the hash of the artifact it built.

v1.0.3 · current

Version 1.0.3

Full source (subscribers)

Implementation sha256 Published CWE-1357

Verifies: Base images pinned by digest, CI actions pinned by commit SHA, and the CI declared the hash of the artifact it built.
Inputs: Dockerfiles, .github/workflows/*.yml and the artifact declaration of the run. Paths listed in excludes (test, spec and tmp files, __tests__, __mocks__, fixtures, test, tests and audit-scripts folders) are never analysed.
Decision rule: Not applicable when the run declares no artifact hash (no artifactSha256, imageDigest or codeSha256): the hash is an input of the run, not a property of the checkout, and a manual run launched from the app never has one, so the check reports not-applicable with that reason and no findings instead of failing the repository (1.0.3). When the run declares the artifact: FAIL on an unpinned base image; unpinned actions are medium findings. Not judged by this check (declared): the build recipe of a run without a declared artifact, and whether the declared hash matches the artifact actually deployed (source-snapshot verification).
Type: deterministic

1.0.3: the artifact hash is an input of the RUN, not a property of the checkout: a run that declares none (a manual run launched from the app) is not-applicable with the reason "artifact hash not provided by this run mode" and no findings, never a FAIL; with an artifact declared the rule is unchanged. (1.0.2: never analyses temporary files (*.tmp.*; spec.excludes follows AUDITOR_ANALYSIS_EXCLUDES). (1.0.1: never analyses test, spec, fixture and mock paths nor the auditor's own scripts (spec.excludes = AUDITOR_ANALYSIS_EXCLUDES); a fixture-looking secret (sk_test_, example, dummy) in real code is LOW, informative.))

if (!artifact.sha256 && !artifact.imageDigest && !artifact.codeSha256) return { status: 'not-applicable', summary: 'not applicable: artifact hash not provided by this run mode', findings: [] };

const m = /^s*FROMs+([^s]+)/i.exec(line);

if (m && !/@sha256:[0-9a-f]{64}/.test(m[1])) findings.push({ severity: 'high', path, line: i + 1, message: `base image ${m[1]} is not pinned by digest` });

The full script is disclosed on request in a read-only viewer (never published on GitHub); the attestation binds to this exact hash.