From 83439730f2645aa825181fc12f8c7b33d058cf03 Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Thu, 11 Jun 2026 01:10:55 -0700 Subject: [PATCH] ci(pre-commit): fetch Trivy installer from pinned release tag The Install Trivy step fetched contrib/install.sh from the mutable main branch of aquasecurity/trivy and piped it straight into sh, so a malicious or accidental change to that script on main would execute arbitrary code on the CI runner, the exact supply-chain weakness the adjacent tflint step already guards against. Fetch the installer from the same pinned release tag as the Trivy binary (v0.69.3, via a TRIVY_VERSION env var so the pin lives in one place), download it to a file before executing it, and use curl -fsSL with set -euo pipefail so transport errors fail loudly instead of feeding an HTML error page into sh. This matches the tflint installer pattern in the same workflow. Verified with actionlint and by running the pinned-tag installer end-to-end with the same arguments (installs trivy 0.69.3). Closes #1187 --- .github/workflows/pre-commit.yml | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index 7cd4f522a..be83eb6f4 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -151,10 +151,20 @@ jobs: # of those tags makes install bail silently after detecting the # version. v0.69.3 ships the standard `trivy__Linux-64bit.tar.gz` # asset. + # + # The installer itself is fetched from the same pinned release tag + # (not the mutable `main` branch) and downloaded to a file before + # execution, matching the tflint step above: a malicious or + # accidental change to install.sh on main can't silently execute + # on this CI runner, and `curl -fsSL` makes transport errors fail + # loudly instead of piping an HTML error page into sh. + env: + TRIVY_VERSION: v0.69.3 run: | - set -eo pipefail - curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \ - | sh -s -- -b /usr/local/bin v0.69.3 + set -euo pipefail + curl -fsSL -o /tmp/trivy-install.sh \ + "https://raw.githubusercontent.com/aquasecurity/trivy/${TRIVY_VERSION}/contrib/install.sh" + sh /tmp/trivy-install.sh -b /usr/local/bin "${TRIVY_VERSION}" - name: Install git-secrets # Pinned to a release tag rather than master HEAD. After install