DevSecOps › Module 3 › Lesson 2
Permissions Pinning
Permissions pinning literacy names action SHA pins, dependency lockfiles, and immutable tags — document pin strategy on YOUR $DEVSEC_LAB before merging workflow changes.
Visual · t36_permissions_pinning
Permissions pinning literacy. $DEVSEC_LAB only. Original Cyberlium.
Opening
Floating @main on third-party actions is a moving target — literacy teaches SHA pinning so CI dependencies stay reproducible on repos you own.
Pinning fixes supply-chain drift — GitHub Actions uses full commit SHAs instead of branch tags, container images use digest pins, npm/pip lockfiles freeze dependency graphs. Renovate or Dependabot opens PRs to bump pins with review on YOUR repo. Permissions blocks pair with pins so compromised actions have minimal blast radius. Cyberlium writes pin row on YOUR $DEVSEC_LAB — one action SHA pin, one image digest note, one lockfile policy for fictional CI. Next: Runner Hygiene.
1. Pinning components (named)
Action pins: uses: org/action@abc1234fullsha — not @v3 floating. Image pins: image@sha256:digest. Lockfiles: package-lock.json, poetry.lock committed on YOUR repo. Bump process: PR review, CI green, changelog note.
On $DEVSEC_LAB, write pin row — artifact type, pin format, review owner for one fictional workflow.
Command guide
Try these commands — Pinning components (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Gitleaks — https://gitleaks.io/ GitHub Actions security — https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions CISA Secure by Design — https://www.cisa.gov/securebydesign
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
export DEVSEC_REPO=${DEVSEC_REPO:-$DEVSEC_LAB/sample-repo}
cat > "$DEVSEC_REPO/.env.example" <<'EOF'
# FAKE lab secrets — DO NOT use in production — labeled FAKE for gitleaks exercise
DATABASE_URL=postgresql://FAKE_USER:FAKE_PASS@localhost:5432/FAKE_DB
API_KEY=FAKE_sk_live_00000000000000000000000000000000
AWS_ACCESS_KEY_ID=FAKEAKIA00000000000000
AWS_SECRET_ACCESS_KEY=FAKEwJalrXUtnFEMI/K7MDENG/bPxRfiCYFAKEKEY
JWT_SECRET=FAKE_jwt_secret_for_lab_only_not_real
STRIPE_SECRET_KEY=FAKE_sk_test_000000000000000000000000
EOFCommand — copy this
cat > "$DEVSEC_REPO/README.md" <<'EOF' # Cyberlium DevSec Lab Sample Repo — YOUR tree only FAKE secrets in `.env.example` for gitleaks literacy — never commit real credentials. Run: gitleaks detect --source . --verbose NEVER scan stranger GitHub orgs. EOF
Command — copy this
cat > "$DEVSEC_REPO/.gitignore" <<'EOF' .env *.pem node_modules/ EOF
Command — copy this
grep -E 'FAKE|NEVER' "$DEVSEC_REPO/.env.example" "$DEVSEC_REPO/README.md"
python3 -c "print('Sample repo seeded with FAKE .env.example — no real secrets')"Primary tools to practice this lesson: grep, python3. Reference sites: Gitleaks (https://gitleaks.io/); GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions); CISA Secure by Design (https://www.cisa.gov/securebydesign). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why pinning beats trust-on-first-use
Tag retag attacks replace v1.2.3 with malicious commits. Unpinned actions pull upstream changes silently. Lab repos practice pin discipline before production pipelines adopt org-wide policy.
Students document lab pin strategy on notes — production follows artifact signing and approved action allowlists.
3. Lab boundary
Forbidden: importing stranger org action pins without verifying on YOUR repo. Allowed: permissions pinning card — three pin types with $DEVSEC_LAB fictional example.
Ship: permissions pinning card for YOUR lab workflow. Next: Runner Hygiene.
4. What you ship: permissions pinning card for $DEVSEC_LAB
Action SHA, image digest, lockfile policy. $DEVSEC_LAB named. chmod 600.
5. What you record before the next lesson
Date. Pinning card. $DEVSEC_LAB named. File t36-m03-l02-permissions-pinning.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Use @main on all third-party actions. Skip lockfiles because 'lab is small.'
Right
Write permissions pinning card for YOUR $DEVSEC_LAB. Next: Runner Hygiene.
Mission: document pinning on YOUR lab workflow
1) Define action SHA, image digest, lockfile pins. 2) Write pin row for one CI job. 3) Name bump review owner. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Pin the action SHA — tags are labels, not guarantees.
Knowledge Check
APPLY: Action pinning primarily uses:
Multiple choice
Knowledge Check
APPLY: True or False: Lockfiles should be committed on YOUR repo for reproducible builds.
True or False
Knowledge Check
APPLY: Pinning literacy on Cyberlium uses:
Multiple choice