Permissions Pinning

Permissions pinning literacy names action SHA pins, dependency lockfiles, and immutable tags — document pin strategy on YOUR $DEVSEC_LAB before merging workflow changes.

Permissions Pinning• Audio Walkthrough

00:00/03:24

Visual · t36_permissions_pinning

Permissions pinning literacy. $DEVSEC_LAB only. Original Cyberlium.

Floating @main on third-party actions is a moving target — literacy teaches SHA pinning so CI dependencies stay reproducible on repos you own.

Pinning fixes supply-chain drift — GitHub Actions uses full commit SHAs instead of branch tags, container images use digest pins, npm/pip lockfiles freeze dependency graphs. Renovate or Dependabot opens PRs to bump pins with review on YOUR repo. Permissions blocks pair with pins so compromised actions have minimal blast radius. Cyberlium writes pin row on YOUR $DEVSEC_LAB — one action SHA pin, one image digest note, one lockfile policy for fictional CI. Next: Runner Hygiene.

1. Pinning components (named)

Action pins: uses: org/action@abc1234fullsha — not @v3 floating. Image pins: image@sha256:digest. Lockfiles: package-lock.json, poetry.lock committed on YOUR repo. Bump process: PR review, CI green, changelog note.

On $DEVSEC_LAB, write pin row — artifact type, pin format, review owner for one fictional workflow.

Command guide

Try these commands — Pinning components (named)

═══ DOCKER & CONTAINER AUDIT ═══

Check container running state and port bindings

Command — copy this

docker ps --format "table {{.ID}}	{{.Image}}	{{.Status}}	{{.Ports}}" 2>/dev/null || echo "docker ps"

Inspect container for elevated capabilities and root user

Command — copy this

docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || true

Run security vulnerability scan on container image using Trivy

Command — copy this

trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"

═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace

Command — copy this

kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"

Primary tools to practice this lesson: grep, python3. Reference sites: Gitleaks (https://gitleaks.io/); GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions); CISA Secure by Design (https://www.cisa.gov/securebydesign). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Why pinning beats trust-on-first-use

Tag retag attacks replace v1.2.3 with malicious commits. Unpinned actions pull upstream changes silently. Lab repos practice pin discipline before production pipelines adopt org-wide policy.

Students document lab pin strategy on notes — production follows artifact signing and approved action allowlists.

3. Lab boundary

Forbidden: importing stranger org action pins without verifying on YOUR repo. Allowed: permissions pinning card — three pin types with $DEVSEC_LAB fictional example.

Ship: permissions pinning card for YOUR lab workflow. Next: Runner Hygiene.

4. What you ship: permissions pinning card for $DEVSEC_LAB

Action SHA, image digest, lockfile policy. $DEVSEC_LAB named. chmod 600.

5. What you record before the next lesson

Date. Pinning card. $DEVSEC_LAB named. File t36-m03-l02-permissions-pinning.txt chmod 600.

6. Wrong vs right: stranger orgs vs YOUR repos

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Use @main on all third-party actions. Skip lockfiles because 'lab is small.'
Right: Write permissions pinning card for YOUR $DEVSEC_LAB. Next: Runner Hygiene.

Hands-on Exercise