Replace GH action versions with specific commit hashes #1
Conversation
Specify action version commit hashes in build.yml
|
@jzemmels, I looked into the failing CI job messages and found an insight here: percy/exec-action#23. I'm wondering if we should update the actions to their latest release hashes. My guess is that changes were made to make the v2/v3 actions forward compatible, but not the actual hash versions. Additionally, do you mind changing the target of this merge request from |
Sure, we can update to the most recent versions' commit hashes and see if that fixes the issue. |
|
Looks good! |
There is a potential security risk where the maintainer of a GitHub Action could retroactively change the code associated with specific, tagged versions of the action (e.g., v1, v2). Laura DeCicco proposed an alternative to replace version numbers in GitHub Action yml files with the specific commit hashes associated with those release versions, which are immutable.
This PR makes those changes for the seven instances where an external action is invoked. I couldn't identify the exact version for some of the actions (e.g., there are multiple v2.#.# versions for checkout), which may explain why the build actions are currently failing. Or perhaps I don't have the permissions to run certain commands in the repo. Feel free to propose different commit hashes if you know more than I do about the action versions.