npm だけでなく、GitHub Actions もサプライチェーン攻撃から守る方法

name: Update dependencies

on:
  schedule:
    # 毎週月曜日の朝 9:00 (日本時間) に実行
    - cron: "0 0 * * 1"
  workflow_dispatch:

jobs:
  update-dependencies:
    runs-on: ubuntu-latest

    permissions:
      contents: write
      pull-requests: write

    steps:
      - uses: actions/checkout@v7

      - uses: pnpm/action-setup@v6
        with:
          version: latest

      - uses: actions/setup-node@v6
        with:
          node-version: 24

      - run: pnpm install

      - run: pnpm update --latest

      # 以降、コミット・プッシュと Pull Request の作成

brew install zizmor

zizmor .github/workflows/update-dependencies.yml

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/update-dependencies.yml:18:9
   |
18 |       - uses: actions/checkout@v7
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

help[template-injection]: code injection via template expansion
  --> .github/workflows/update-dependencies.yml:61:25
   |
57 |         run: |
   |         --- this run block
...
61 |             --head "${{ env.BRANCH_NAME }}" \
   |                         ^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/update-dependencies.yml:18:15
   |
18 |       - uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/update-dependencies.yml:20:15
   |
20 |       - uses: pnpm/action-setup@v6
   |               ^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/update-dependencies.yml:24:15
   |
24 |       - uses: actions/setup-node@v6
   |               ^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

9 findings (4 suppressed, 2 unsafe fixes): 0 informational, 2 low, 0 medium, 3 high

# 変更前
- uses: actions/checkout@v7

# 変更後
- uses: actions/checkout@<SHA> # v7.x.x

pinact run

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
    cooldown:
      default-days: 7

{
  "packageManager": "pnpm@11.13.1"
}

- uses: pnpm/action-setup@<SHA> # v6.x.x
  # version は省略し、package.json の packageManager を使う

permissions: {}

jobs:
  update:
    permissions:
      contents: read

name: Update dependencies

on:
  schedule:
    # 毎週月曜日の朝 9:00 (日本時間) に実行
    - cron: "0 0 * * 1"
  workflow_dispatch:

# ワークフロー全体のデフォルトは権限なし
permissions: {}

# このワークフローではキャッシュを使わない
cache-mode: none

jobs:
  # 依存関係を更新するジョブ（サードパーティのコードが動く）
  update:
    runs-on: ubuntu-latest

    permissions:
      contents: read

    outputs:
      changed: ${{ steps.diff.outputs.changed }}

    steps:
      - uses: actions/checkout@<SHA> # v7.x.x
        with:
          # このジョブでは push しないので認証情報を残さない
          persist-credentials: false

      # version は省略し、package.json の packageManager を使う
      - uses: pnpm/action-setup@<SHA> # v6.x.x

      - uses: actions/setup-node@<SHA> # v6.x.x
        with:
          node-version: 24

      - run: pnpm install

      # 依存関係を最新バージョンに更新する
      - run: pnpm update --latest

      - name: Check for changes
        id: diff
        run: |
          if git diff --quiet -- package.json pnpm-lock.yaml; then
            echo "changed=false" >> "$GITHUB_OUTPUT"
          else
            echo "changed=true" >> "$GITHUB_OUTPUT"
          fi          

      - if: steps.diff.outputs.changed == 'true'
        uses: actions/upload-artifact@<SHA> # v7.x.x
        with:
          name: updated-dependencies
          path: |
            package.json
            pnpm-lock.yaml            
          retention-days: 1

  # Pull Request を作成するジョブ（書き込み権限を持つが、サードパーティのコードは動かさない）
  create-pr:
    needs: update
    if: needs.update.outputs.changed == 'true'
    runs-on: ubuntu-latest

    permissions:
      contents: write
      pull-requests: write

    steps:
      - uses: actions/checkout@<SHA> # v7.x.x
        with:
          # push に使うので認証情報を残す
          persist-credentials: true

      - uses: actions/download-artifact@<SHA> # v8.x.x
        with:
          name: updated-dependencies
          # .git を含むワークスペースには直接展開しない
          path: ${{ runner.temp }}/updated-dependencies

      - name: Commit and Push
        env:
          BRANCH_NAME: update-dependencies
        run: |
          # Artifact から想定したファイルだけを取り出す
          cp "$RUNNER_TEMP/updated-dependencies/package.json" package.json
          cp "$RUNNER_TEMP/updated-dependencies/pnpm-lock.yaml" pnpm-lock.yaml

          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          git checkout -b "$BRANCH_NAME"

          git add package.json pnpm-lock.yaml
          git commit -m "Update dependencies"
          git push origin "$BRANCH_NAME"          

      - name: Create Pull Request
        env:
          # ghコマンドの認証に必要
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          BRANCH_NAME: update-dependencies
        run: |
          gh pr create \
            --title "Update dependencies" \
            --body "GitHub Actionsから \`gh\` コマンドを使用して自動生成されたプルリクエストです。" \
            --head "$BRANCH_NAME" \
            --base "main"