Add the cicd-gha-unpinned-action rule to the catalog

scanners/boostsecurityio/baseline/module.yaml

@@ -41,7 +41,7 @@ steps:
     - scan:
         command:
           docker:
-            image: ghcr.io/boostsecurityio/scanner-publishing/boost-scanner-native:6b6cf90@sha256:285e3bd9b11cf47c5e28d501eca0dd70a139f8c02ec1d9a469ba69d3d77dd8f9
+            image: ghcr.io/boostsecurityio/scanner-publishing/boost-scanner-native:8f8a409@sha256:7254ed0df115e4fb5bbf362db17bd87b6c28d7ee8a815f73645bfec217676aa6
             command: scanner scan
             workdir: /src
           name: scanner

scanners/boostsecurityio/scanner/rules.yaml

@@ -107,6 +107,22 @@ rules:
     pretty_name: CI/CD - GitHub Action Unsecure Commands
     ref: '{BOOSTSEC_DOC_BASE_URL}/rules/cicd-gha-unsecure-commands.html'
     recommended: true
+  cicd-gha-unpinned-action:
+    categories:
+      - ALL
+      - supply-chain
+      - supply-chain-missing-artifact-integrity-verification
+      - boost-baseline
+      - boost-hardened
+    description: Checks for GitHub Action workflows and composite actions referencing
+      actions or reusable workflows that are not pinned to a full commit SHA. A
+      mutable reference such as a branch or a tag can be repointed at different code
+      after review, so the pinned artifact is not the one that was audited.
+    group: supply-chain-missing-artifact-integrity-verification
+    name: cicd-gha-unpinned-action
+    pretty_name: CI/CD - GitHub Action Unpinned Action
+    ref: '{BOOSTSEC_DOC_BASE_URL}/rules/cicd-gha-unpinned-action.html'
+    recommended: true
   cicd-unpinned-dependencies:
     categories:
       - ALL