[uk-ai-resilience] [security] Pin docker/build-push-action to SHA in publish-safe-outputs-node.yml (CodeQL #625, CWE-829)

[github-actions]

Summary

CodeQL alert #625 (created 2026-06-14, open 17 days) flags an unpinned third-party GitHub Action in the safe-outputs publish pipeline.

File: .github/workflows/publish-safe-outputs-node.yml line 193
Rule: actions/unpinned-tag (CWE-829 — inclusion of functionality from untrusted control sphere)
Severity: Medium (supply chain)

Tier & Risk Scoring

Dimension	Score	Notes
Exposure amplification	3	Publish pipeline for safe-outputs Node image — compromise affects all consumers
Patchability	1	One-line SHA pin with version comment
Detectability	4	Tag can be silently updated by upstream repo
Operational fragility	4	Compromised image could affect all workflow runs using safe-outputs
Ownership confidence	3	CI/pipeline ownership active but alert unaddressed 17 days
Aggregate	15	Tier B — Open With Conditions

SLA: High — fix within 7 days.

Root Cause

.github/workflows/publish-safe-outputs-node.yml:193 uses:

uses: docker/build-push-action@v7.2.0

A tag reference is mutable — the upstream maintainer can push a new commit to the same tag, silently changing the code that executes in this workflow. This is the documented supply-chain attack vector (CWE-829).

Recommended Fix

Pin to the full commit SHA for docker/build-push-action@v7.2.0:

uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v7.2.0

Verify the SHA from the docker/build-push-action release page or via gh api repos/docker/build-push-action/git/refs/tags/v7.2.0.

Governance Context

Identified by the UK AI Open Code Risk & Resilience Governance weekly scan (2026-07-01). See discussion report for full tier classification and remediation queue.

References: CodeQL alert #625 · §28531380129

Generated by UK AI Operational Resilience · 117.9 AIC · ⌖ 10.5 AIC · ⊞ 5.2K · ◷