Test fixture for StepSecurity's Action-Uses-Imposter-Commit detection and the
per-action@sha false-positive review verdict.
This repo is deliberately structured so that one of its commits is unreachable
from any branch. Do not "fix" the dangling commit or delete the v1 tag —
that is the whole point of the fixture.
| Ref | Reachable from a branch? | Expected detection |
|---|---|---|
main tip / tag v1.0.0 |
yes (main) |
not flagged — negative control |
tag v1 |
no — commit sits on top of main but was never pushed to a branch |
flagged as imposter commit |
refContains compares refs/heads/<branch>...<sha> for the default branch and
then every other branch, and treats the SHA as legitimate only when the compare
status is behind or identical — i.e. the commit is already an ancestor of
that branch. The v1 commit is a child of the main tip, so every comparison
returns ahead, no branch contains it, and the analysis marks it as an imposter
commit.
This is the same shape as a real supply-chain attack: push a commit that is on no branch, then repoint a tag at it.
See .github/workflows/consume-action.yml for a sample consuming workflow. Pin
the SHA you want to exercise; the consuming repo must have an active
StepSecurity subscription and run harden-runner for the run to be correlated.