Resolve Zizmor error alerts for unpinned image references; mark alert for pull_request_target ignored

[pankajkoti]

scan results from this PR: https://github.com/astronomer/astronomer-cosmos/security/code-scanning?query=is%3Aopen+pr%3A1888

vs

on main: https://github.com/astronomer/astronomer-cosmos/security/code-scanning (this will change after merging this PR, but can be compared while the PR is still open)

related: https://github.com/astronomer/oss-integrations-private/issues/156

[netlify]

✅ Deploy Preview for sunny-pastelito-5ecb04 canceled.

Name	Link
🔨 Latest commit	251615a
🔍 Latest deploy log	https://app.netlify.com/projects/sunny-pastelito-5ecb04/deploys/688391d9b728b00008d2e5b5

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.91%. Comparing base (fdf0f72) to head (251615a).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1888      +/-   ##
==========================================
- Coverage   97.91%   97.91%   -0.01%     
==========================================
  Files          85       85              
  Lines        5330     5329       -1     
==========================================
- Hits         5219     5218       -1     
  Misses        111      111              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull Request Overview

This PR addresses Zizmor security scanner alerts by pinning Docker image and GitHub Actions references to specific SHA hashes and versions, while also documenting the intentional use of pull_request_target with security justifications.

• Pin unpinned container images and GitHub Actions to specific SHA hashes with version comments
• Add documentation and Zizmor ignore directive for pull_request_target trigger usage
• Update workflow comments to explain security considerations for fork-based pull requests

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.github/workflows/test.yml	Pin postgres container images to SHA hash, pin GitHub Actions to specific commits, and document pull_request_target security considerations
.github/workflows/docs.yml	Pin sphinx-notes/pages action to specific commit hash
.github/workflows/deploy.yml	Pin pypa/gh-action-pypi-publish action to specific commit hash

Comments suppressed due to low confidence (1)

.github/workflows/test.yml:131

• The comment indicates this is PostgreSQL version 14.18, but PostgreSQL 14.18 does not exist. The latest version in the 14.x series is 14.13. Please verify the correct version and update the comment accordingly.

        image: postgres@sha256:4cd697181d4bd3ddc41a09012f339fa8cb5a8cd3d8b30130ea8378c176b6c494  # 14.18

[tatiana]

@pankajkoti thanks a lot for doing further security improvements in the repo.

Two questions:

1. Why are we using the Git hash (76f52bc884231f62b9a034ebfe128415bbaabdfc) instead of the tag (e.g v1.12.4)?

2. Currently we're using GH Dependabot to keep our GitHub Actions dependencies up-to-date, including with the latest security fixes. Will the approach of pinning a GH commit hash also work with this?

[pankajkoti]

Two questions:

1. Why are we using the Git hash (76f52bc884231f62b9a034ebfe128415bbaabdfc) instead of the tag (e.g v1.12.4)?

Zizmor still complains about v1.12.4 as they(tags) are replaceable and mutable whereas commit SHAs are immutable and irreplacable making them secure.

2. Currently we're using GH Dependabot to keep our GitHub Actions dependencies up-to-date, including with the latest security fixes. Will the approach of pinning a GH commit hash also work with this?

I looked a bit into this. GitHub recommends having commit SHAs for 3rd party Actions. And as long as we mention the correspondign versions in comments against those SHAs, dependabot will be able to read and use those for it's functioning. They added this support in dependabot/dependabot-core#5951

[tatiana]

Looks great, thanks for claryfing the Dependabot behaviour, @pankajkoti !