impostorcommit

README

impostor-commit

Checks that a commit SHA pinned in an action reference is reachable from a branch or tag in the referenced repository.

Risk

GitHub shares object storage across forks. An attacker can create a malicious commit in a fork of a popular action and reference it using the original repository's namespace (e.g., actions/checkout@<fork-commit-sha>). The SHA resolves successfully, but the executed code was never part of the original repository's history. This is known as an "impostor commit" attack.

Because the uses line looks identical to a legitimate SHA-pinned reference, this attack is difficult to detect during code review.

Examples

Bad ❌

steps:
  # This SHA exists only in a fork — it was never merged into actions/checkout.
  - uses: actions/checkout@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Good ✅

steps:
  # This SHA belongs to the v6.0.2 tag on the actions/checkout repository.
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

Pin to a commit SHA that is reachable from a branch or tag in the action's repository. This rule verifies reachability via the GitHub API. It checks both workflow files and action metadata files (composite action steps).

Documentation

Index

• type CommitVerifier
• type Rule
  • func (r *Rule) CheckAction(mapping workflow.ActionMapping) []*diagnostic.Error
  • func (r *Rule) CheckWorkflow(mapping workflow.WorkflowMapping) []*diagnostic.Error
  • func (r *Rule) Fix() string
  • func (r *Rule) ID() string
  • func (r *Rule) Online() bool
  • func (r *Rule) Required() bool
  • func (r *Rule) Why() string

Types

type CommitVerifier

type CommitVerifier interface {
	VerifyCommit(ctx context.Context, owner, repo, sha string) (bool, error)
}

CommitVerifier checks whether a commit SHA is reachable from any branch or tag in the given repository.

type Rule

type Rule struct {
	Verifier CommitVerifier
}

func (*Rule) CheckAction

func (r *Rule) CheckAction(mapping workflow.ActionMapping) []*diagnostic.Error

func (*Rule) CheckWorkflow

func (r *Rule) CheckWorkflow(mapping workflow.WorkflowMapping) []*diagnostic.Error

func (*Rule) Fix

func (r *Rule) Fix() string

func (*Rule) ID

func (r *Rule) ID() string

func (*Rule) Online

func (r *Rule) Online() bool

func (*Rule) Required

func (r *Rule) Required() bool

func (*Rule) Why

func (r *Rule) Why() string