Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replace unpinned actions with pinned action #19

Merged
merged 1 commit into from
Dec 4, 2023

Conversation

jhrozek
Copy link
Contributor

@jhrozek jhrozek commented Dec 4, 2023

This is a Minder automated pull request.

This pull request replaces references to actions by tag to references to actions by SHA.

Verifies that any actions use pinned tags
Pinning an action to a full length commit SHA is currently the only way to use
an action as an immutable release. Pinning to a particular SHA helps mitigate
the risk of a bad actor adding a backdoor to the action's repository, as they
would need to generate a SHA-1 collision for a valid Git object payload.
When selecting a SHA, you should verify it is from the action's repository
and not a repository fork.

For more information, see
https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions

@jhrozek jhrozek force-pushed the minder_replace_unpinned_actions_with_pinned_action branch from a4c6f17 to f303197 Compare December 4, 2023 15:11
@jhrozek jhrozek merged commit 7a62e79 into main Dec 4, 2023
5 checks passed
jhrozek added a commit that referenced this pull request Dec 4, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant