Description
A security vulnerability came my way that we can do a quick fix for. In our GitHub Actions, we refer to the action by version tag rather than by commit SHA:
|
- uses: actions/checkout@v6 |
Instead we should do something like
actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
The reason why is because a tag can be moved to point to malicious code which can then mess up our repo when an action is run. After the fix, dependabot can update the SHA as needed.
Is your feature request aligned with the scope of the package?
Describe the solution you'd like, or your current workaround.
Two steps:
- Update the workflows to point to the SHAs
- Configure dependabot to bump the SHAs as needed
Do you have any additional supporting notes?
https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/find-and-customize-actions#using-tags
Would you be willing to contribute this ticket?
Description
A security vulnerability came my way that we can do a quick fix for. In our GitHub Actions, we refer to the action by version tag rather than by commit SHA:
chainladder-python/.github/workflows/pytest.yml
Line 21 in 4533ef6
Instead we should do something like
The reason why is because a tag can be moved to point to malicious code which can then mess up our repo when an action is run. After the fix, dependabot can update the SHA as needed.
Is your feature request aligned with the scope of the package?
Describe the solution you'd like, or your current workaround.
Two steps:
Do you have any additional supporting notes?
https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/find-and-customize-actions#using-tags
Would you be willing to contribute this ticket?