From 99897a47dd3c128c6277c318601a59a71ec09a61 Mon Sep 17 00:00:00 2001
From: "aikido-autofix[bot]"
 <119856028+aikido-autofix[bot]@users.noreply.github.com>
Date: Thu, 8 Oct 2026 14:13:38 +0000
Subject: [PATCH] fix(security): Pinned safe-chain version and added SHA256
 checksum verification across all CI...

---
 .github/workflows/benchmark.yml      |  9 ++++++++-
 .github/workflows/end2end.yml        |  9 ++++++++-
 .github/workflows/lint.yml           |  9 ++++++++-
 .github/workflows/publish.yml        |  9 ++++++++-
 .github/workflows/qa-tests.yml       |  9 ++++++++-
 .github/workflows/smoke-test-ffi.yml | 19 +++++++++++++++++--
 .github/workflows/test-publish.yml   |  9 ++++++++-
 .github/workflows/unit-test.yml      |  9 ++++++++-
 8 files changed, 73 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 4f7efc820..2e88ac713 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -24,7 +24,14 @@ jobs:
         with:
           python-version: 3.9
       - name: Setup safe-chain
-        run: curl -fsSL https://github.com/AikidoSec/safe-chain/releases/latest/download/install-safe-chain.sh | sh -s -- --ci
+        env:
+          SAFECHAIN_VERSION: "1.0.0"
+          SAFECHAIN_SHA256: "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        run: |
+          curl -fsSL -o install-safe-chain.sh "https://github.com/AikidoSec/safe-chain/releases/download/v${SAFECHAIN_VERSION}/install-safe-chain.sh"
+          echo "${SAFECHAIN_SHA256}  install-safe-chain.sh" | sha256sum -c -
+          sh install-safe-chain.sh --ci
+          rm install-safe-chain.sh
 
       - name: Install dependencies
         run: |
diff --git a/.github/workflows/end2end.yml b/.github/workflows/end2end.yml
index 62df2b8d4..198b85070 100644
--- a/.github/workflows/end2end.yml
+++ b/.github/workflows/end2end.yml
@@ -65,7 +65,14 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
       - name: Setup safe-chain
-        run: curl -fsSL https://github.com/AikidoSec/safe-chain/releases/latest/download/install-safe-chain.sh | sh -s -- --ci
+        env:
+          SAFECHAIN_VERSION: "1.0.0"
+          SAFECHAIN_SHA256: "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        run: |
+          curl -fsSL -o install-safe-chain.sh "https://github.com/AikidoSec/safe-chain/releases/download/v${SAFECHAIN_VERSION}/install-safe-chain.sh"
+          echo "${SAFECHAIN_SHA256}  install-safe-chain.sh" | sha256sum -c -
+          sh install-safe-chain.sh --ci
+          rm install-safe-chain.sh
 
       - name: Install dependencies
         run: |
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 6d88d5e38..982af1090 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -18,7 +18,14 @@ jobs:
       with:
         python-version: '3.14'
     - name: Setup safe-chain
-      run: curl -fsSL https://github.com/AikidoSec/safe-chain/releases/latest/download/install-safe-chain.sh | sh -s -- --ci
+      env:
+        SAFECHAIN_VERSION: "1.0.0"
+        SAFECHAIN_SHA256: "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+      run: |
+        curl -fsSL -o install-safe-chain.sh "https://github.com/AikidoSec/safe-chain/releases/download/v${SAFECHAIN_VERSION}/install-safe-chain.sh"
+        echo "${SAFECHAIN_SHA256}  install-safe-chain.sh" | sha256sum -c -
+        sh install-safe-chain.sh --ci
+        rm install-safe-chain.sh
 
     - name: Install dependencies
       run: |
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ddaec2383..70f00bc8f 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -22,7 +22,14 @@ jobs:
           sudo echo "127.0.0.1 local.aikido.io" | sudo tee -a /etc/hosts
 
     - name: Setup safe-chain
-      run: curl -fsSL https://github.com/AikidoSec/safe-chain/releases/latest/download/install-safe-chain.sh | sh -s -- --ci
+      env:
+        SAFECHAIN_VERSION: "1.0.0"
+        SAFECHAIN_SHA256: "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+      run: |
+        curl -fsSL -o install-safe-chain.sh "https://github.com/AikidoSec/safe-chain/releases/download/v${SAFECHAIN_VERSION}/install-safe-chain.sh"
+        echo "${SAFECHAIN_SHA256}  install-safe-chain.sh" | sha256sum -c -
+        sh install-safe-chain.sh --ci
+        rm install-safe-chain.sh
 
     - name: Installation
       run: make dev_install
diff --git a/.github/workflows/qa-tests.yml b/.github/workflows/qa-tests.yml
index 48457844f..f8d108a6f 100644
--- a/.github/workflows/qa-tests.yml
+++ b/.github/workflows/qa-tests.yml
@@ -30,7 +30,14 @@ jobs:
         with:
           python-version: "3.14"
       - name: Setup safe-chain
-        run: curl -fsSL https://github.com/AikidoSec/safe-chain/releases/latest/download/install-safe-chain.sh | sh -s -- --ci
+        env:
+          SAFECHAIN_VERSION: "1.0.0"
+          SAFECHAIN_SHA256: "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        run: |
+          curl -fsSL -o install-safe-chain.sh "https://github.com/AikidoSec/safe-chain/releases/download/v${SAFECHAIN_VERSION}/install-safe-chain.sh"
+          echo "${SAFECHAIN_SHA256}  install-safe-chain.sh" | sha256sum -c -
+          sh install-safe-chain.sh --ci
+          rm install-safe-chain.sh
       - name: Install poetry
         run: pip install poetry
 
diff --git a/.github/workflows/smoke-test-ffi.yml b/.github/workflows/smoke-test-ffi.yml
index 08a90c4b8..2dd131131 100644
--- a/.github/workflows/smoke-test-ffi.yml
+++ b/.github/workflows/smoke-test-ffi.yml
@@ -42,10 +42,25 @@ jobs:
 
       - name: Setup safe-chain (Unix)
         if: runner.os != 'Windows'
-        run: curl -fsSL https://github.com/AikidoSec/safe-chain/releases/latest/download/install-safe-chain.sh | sh -s -- --ci
+        env:
+          SAFECHAIN_VERSION: "1.0.0"
+          SAFECHAIN_SHA256: "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        run: |
+          curl -fsSL -o install-safe-chain.sh "https://github.com/AikidoSec/safe-chain/releases/download/v${SAFECHAIN_VERSION}/install-safe-chain.sh"
+          echo "${SAFECHAIN_SHA256}  install-safe-chain.sh" | sha256sum -c -
+          sh install-safe-chain.sh --ci
+          rm install-safe-chain.sh
       - name: Setup safe-chain (Windows)
         if: runner.os == 'Windows'
-        run: iex "& { $(iwr 'https://github.com/AikidoSec/safe-chain/releases/latest/download/install-safe-chain.ps1' -UseBasicParsing) } -ci"
+        env:
+          SAFECHAIN_VERSION: "1.0.0"
+          SAFECHAIN_SHA256: "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855"
+        run: |
+          Invoke-WebRequest -Uri "https://github.com/AikidoSec/safe-chain/releases/download/v$env:SAFECHAIN_VERSION/install-safe-chain.ps1" -OutFile install-safe-chain.ps1
+          $hash = (Get-FileHash -Path install-safe-chain.ps1 -Algorithm SHA256).Hash
+          if ($hash -ne $env:SAFECHAIN_SHA256) { throw "Checksum verification failed" }
+          & .\install-safe-chain.ps1 -ci
+          Remove-Item install-safe-chain.ps1
 
       - name: Install dependencies
         run: make install && cp -r .cache/binaries/* aikido_zen/libs
diff --git a/.github/workflows/test-publish.yml b/.github/workflows/test-publish.yml
index b619b106d..5dbbab81d 100644
--- a/.github/workflows/test-publish.yml
+++ b/.github/workflows/test-publish.yml
@@ -24,7 +24,14 @@ jobs:
           sudo echo "127.0.0.1 local.aikido.io" | sudo tee -a /etc/hosts
 
     - name: Setup safe-chain
-      run: curl -fsSL https://github.com/AikidoSec/safe-chain/releases/latest/download/install-safe-chain.sh | sh -s -- --ci
+      env:
+        SAFECHAIN_VERSION: "1.0.0"
+        SAFECHAIN_SHA256: "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+      run: |
+        curl -fsSL -o install-safe-chain.sh "https://github.com/AikidoSec/safe-chain/releases/download/v${SAFECHAIN_VERSION}/install-safe-chain.sh"
+        echo "${SAFECHAIN_SHA256}  install-safe-chain.sh" | sha256sum -c -
+        sh install-safe-chain.sh --ci
+        rm install-safe-chain.sh
 
     - name: Installation
       run: make dev_install
diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml
index 31ca2d8f8..7eff5f84c 100644
--- a/.github/workflows/unit-test.yml
+++ b/.github/workflows/unit-test.yml
@@ -35,7 +35,14 @@ jobs:
       with:
         python-version: ${{ matrix.python-version }}
     - name: Setup safe-chain
-      run: curl -fsSL https://github.com/AikidoSec/safe-chain/releases/latest/download/install-safe-chain.sh | sh -s -- --ci
+      env:
+        SAFECHAIN_VERSION: "1.0.0"
+        SAFECHAIN_SHA256: "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+      run: |
+        curl -fsSL -o install-safe-chain.sh "https://github.com/AikidoSec/safe-chain/releases/download/v${SAFECHAIN_VERSION}/install-safe-chain.sh"
+        echo "${SAFECHAIN_SHA256}  install-safe-chain.sh" | sha256sum -c -
+        sh install-safe-chain.sh --ci
+        rm install-safe-chain.sh
 
     - name: Install dependencies
       run: |