Re: [tractusx-dev] GitHub Actions -> mutable versions -> immutable versi

[Stephan Bauer <stephan.bauer@xxxxxxxxxxxx>]

Dear community,

As discussed in the office hour, I opened a view PRs on several repositories. Since I opened them, I am not able to approve them. Here we need you.

Every one of these PRs replaces mutable version tags (@v4, @master, @main) with 40-character immutable commit SHAs, including a human-readable comment for easier maintenance (e.g., uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2).

Every PR needs to be checked, of course there could be some errors. I tried just to replace the versions … didn’t do an upgrade or something else. It’s in the responsibility of the committer to take care about maintenance of the repositories.

In case the PRs are not approved/adapted, tis might be a sign, that no-one feels responsible -> in this case, this would mean the repository is not needed anymore and it is not maintained -> we would have to deprecate the repository.

Thank you and have a nice weekend.

BTW we also introduced a reusable trivy action in sig-infra

Repository	PR
Traceability FOSS	#1493
Item Relationship Service	#1014
SLDT Digital Twin Registry	#613
SLDT Discovery Finder	#205
SLDT Semantic Hub	#326
SLDT Semantic Models	#980
SLDT BPN Discovery	#195
SSI DIM Wallet Stub	#110
SSI Credential Issuer	#470
Managed Service Orchestrator	#200
Managed Simple Data Exchanger	#60
Simple Data Exchanger Backend	#238
Simple Data Exchanger Frontend	#207
Self-Description Factory	#262
Tractus-X SDK	#231
Identity Hub	#310
Portal (Backend/UI)	#571
SIG Infrastructure	#576
BPN DID Resolution Service	#463
Helm Charts	#150
Tractus-X Umbrella	#1665
Release Automation	#413
Tractus-X Website	#1559
SIG Release	#50
SIG Architecture	#19
Tractus-X Profiles	#26
EDC Kafka Extension	#126
Tutorial Resources	#15
Data Exchange Test Service	#40

Stephan

Stephan Bauer 

Eclipse Tractus-X Project Lead

From: tractusx-dev <tractusx-dev-bounces@xxxxxxxxxxx> on behalf of Mathias Brunkow Moser via tractusx-dev <tractusx-dev@xxxxxxxxxxx>
Date: Friday, 20. March 2026 at 15:19
To: tractusx developer discussions <tractusx-dev@xxxxxxxxxxx>
Cc: Mathias Brunkow Moser <mathias.moser@xxxxxxxxxxxx>
Subject: [tractusx-dev] Trivy & Trivy

Dear Eclipse Tractus-X Community,

We have disabled all the Trivy github actions.

There was an attack which was executed not long ago in the trivy version 0.69.4.

Can be found here:

https://opensourcemalware.com/repository/https%3A%2F%2Fgithub.com%2Faquasecurity%2Ftrivy%2F 

Apparently, it may affect us, so we as committers have decided to be cautious and disable all the Trivy workflows in GITHUB.  Until we can confirm if we’re affected or not. Please also check if you have a "fork" if you have executed it with this version or the trivy-actions without the hash.

Here is the story:

https://www.stepsecurity.io/blog/trivy-compromised-a-second-time---malicious-v0-69-4-release#what-happened 

Remember when we said you **must** indicate the commit hash into the workflow. THIS was one of the reasons why. However we have identified that this rule was not followed in several repositories.

What we have not yet identified if we are affected (which did not specify a hashed version) or if there was a run of trivy since monday which was executed via "trivy-actions" which contained a version with malware.

We have informed the eclipse foundation via Help Desk already: https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/issues/7297 (private issue)

We have identified that the following repositories are not using the “hashed” workflow version (which may have run since monday a version with the malware):

• https://github.com/eclipse-tractusx/tractusx-edc
• https://github.com/eclipse-tractusx/item-relationship-service
• https://github.com/eclipse-tractusx/managed-simple-data-exchanger-frontend
• https://github.com/eclipse-tractusx/tractusx-edc-kafka-extension
• https://github.com/eclipse-tractusx/sldt-semantic-hub
• https://github.com/eclipse-tractusx/bpdm
• https://github.com/eclipse-tractusx/sd-factory
• https://github.com/eclipse-tractusx/sldt-digital-twin-registry
• https://github.com/eclipse-tractusx/managed-simple-data-exchanger-backend
• https://github.com/eclipse-tractusx/traceability-foss
• https://github.com/eclipse-tractusx/sldt-bpn-discovery
• https://github.com/eclipse-tractusx/bpn-did-resolution-service
• https://github.com/eclipse-tractusx/tractusx-identityhub

We have check most and it looks like it has not happened, but we still need to check it deeper.

Also archived repos have no hash, but they are out of scope:

• https://github.com/eclipse-tractusx/bpdm-certificate-management
• https://github.com/eclipse-tractusx/digital-product-pass
• https://github.com/eclipse-tractusx/policy-hub
• https://github.com/eclipse-tractusx/vas-country-risk
• https://github.com/eclipse-tractusx/vas-country-risk-backend
• https://github.com/eclipse-tractusx/daps-registration-service
• https://github.com/eclipse-tractusx/puris-frontend
• https://github.com/eclipse-tractusx/tractusx-issuerservice
• https://github.com/eclipse-tractusx/traceability-foss-backend
• https://github.com/eclipse-tractusx/managed-identity-wallet
• https://github.com/eclipse-tractusx/managed-identity-wallets-archived

So, this is a call for all committers to NOT enable their Trivy workflow GitHub Actions until we have sorted this out, discussed a way forward and estimated the impact.

Please make sure to update your workflows in the future to use the “hash” and not the “version” of a package, not only for Trivy example:

https://github.com/eclipse-tractusx/industry-core-hub/blob/809b95d8b35751339528688f80fc86381e2b329e/.github/workflows/trivy.yml#L53

Since in this way if the tag is replaced by an attacker, they still will never be able to replace the git commit.

Please take a look on your forks and see if you are also affected in your organization, also internally. Since the impact observed is that the GitHub Actions Secrets may have been leaked.

Thank you for all the persons which supported us and reported this vulnerability. 

Stay safe,

Your Eclipse Tractus-X Project Leads