DevSecOps › Module 3 › Lesson 2
Permissions Pinning
Permissions pinning literacy names action SHA pins, dependency lockfiles, and immutable tags — document pin strategy on YOUR $DEVSEC_LAB before merging workflow changes.
Visual · t36_permissions_pinning
Permissions pinning literacy. $DEVSEC_LAB only. Original Cyberlium.
Opening
Floating @main on third-party actions is a moving target — literacy teaches SHA pinning so CI dependencies stay reproducible on repos you own.
Pinning fixes supply-chain drift — GitHub Actions uses full commit SHAs instead of branch tags, container images use digest pins, npm/pip lockfiles freeze dependency graphs. Renovate or Dependabot opens PRs to bump pins with review on YOUR repo. Permissions blocks pair with pins so compromised actions have minimal blast radius. Cyberlium writes pin row on YOUR $DEVSEC_LAB — one action SHA pin, one image digest note, one lockfile policy for fictional CI. Next: Runner Hygiene.
1. Pinning components (named)
Action pins: uses: org/action@abc1234fullsha — not @v3 floating. Image pins: image@sha256:digest. Lockfiles: package-lock.json, poetry.lock committed on YOUR repo. Bump process: PR review, CI green, changelog note.
On $DEVSEC_LAB, write pin row — artifact type, pin format, review owner for one fictional workflow.
Command guide
Try these commands — Pinning components (named)
═══ DOCKER & CONTAINER AUDIT ═══
Check container running state and port bindings
Command — copy this
docker ps --format "table {{.ID}} {{.Image}} {{.Status}} {{.Ports}}" 2>/dev/null || echo "docker ps"Inspect container for elevated capabilities and root user
Command — copy this
docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || trueRun security vulnerability scan on container image using Trivy
Command — copy this
trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"
═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace
Command — copy this
kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"
Primary tools to practice this lesson: grep, python3. Reference sites: Gitleaks (https://gitleaks.io/); GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions); CISA Secure by Design (https://www.cisa.gov/securebydesign). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why pinning beats trust-on-first-use
Tag retag attacks replace v1.2.3 with malicious commits. Unpinned actions pull upstream changes silently. Lab repos practice pin discipline before production pipelines adopt org-wide policy.
Students document lab pin strategy on notes — production follows artifact signing and approved action allowlists.
3. Lab boundary
Forbidden: importing stranger org action pins without verifying on YOUR repo. Allowed: permissions pinning card — three pin types with $DEVSEC_LAB fictional example.
Ship: permissions pinning card for YOUR lab workflow. Next: Runner Hygiene.
4. What you ship: permissions pinning card for $DEVSEC_LAB
Action SHA, image digest, lockfile policy. $DEVSEC_LAB named. chmod 600.
5. What you record before the next lesson
Date. Pinning card. $DEVSEC_LAB named. File t36-m03-l02-permissions-pinning.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Use @main on all third-party actions. Skip lockfiles because 'lab is small.'
Right
Write permissions pinning card for YOUR $DEVSEC_LAB. Next: Runner Hygiene.
Mission: document pinning on YOUR lab workflow
1) Define action SHA, image digest, lockfile pins. 2) Write pin row for one CI job. 3) Name bump review owner. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Pin the action SHA — tags are labels, not guarantees.
Knowledge Check
APPLY: Action pinning primarily uses:
Multiple choice
Knowledge Check
APPLY: True or False: Lockfiles should be committed on YOUR repo for reproducible builds.
True or False
Knowledge Check
APPLY: Pinning literacy on Cyberlium uses:
Multiple choice