Repository navigation
workflows: Pin GitHub Actions to commit hashes - #1065
Merged
Merged
Conversation
- Reference every third-party GitHub Action by the full commit hash of the version already in use, with that version in a trailing comment, as `codecov/codecov-action` was already referenced. - A Git tag is mutable, so `actions/checkout@v7.0.1` resolves to whatever commit the tag points at when the workflow runs, and an account takeover or a compromised release is enough to replace it with code of somebody's choosing. This repository's workflows hold the credentials that publish the package to the registry, so that code would run with them. - Dependabot keeps hash references up to date the same way it keeps tag references up to date, as long as the friendly version follows the hash as a comment, so the `github-actions` ecosystem entry in `.github/dependabot.yml` needs no change. - Reusable workflows of `cordada/github-actions-utils` are left referencing `master`, as they are internal to the organization and the branch is the reference the callers are meant to track.
jtrobles-cdd
added
task
|
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A Git tag is mutable, so
actions/checkout@v7.0.1resolves to whatever commit the tag points at when the workflow runs, and an account takeover or a compromised release is enough to move it. These workflows hold the credentials that publish the package to the package registry, so code substituted that way would run with them.codecov/codecov-actionwas already referenced by commit hash, and nothing else was.Scope
codecov/codecov-actionalready used.cordada/github-actions-utilskeep referencing@master, as they are internal to the organization and the branch is the reference the callers are meant to track../.github/workflows/*.yamlcalls inci-cd.yamlare same-repository references and take no version.Dependabot
.github/dependabot.ymlneeds no change: Dependabot updates a hash reference the same way it updates a tag, and rewrites the comment along with it, as long as the friendly version follows the hash as a comment. That is the form used here.How the hashes were obtained
codecov-action@v7.0.0reproduces the hash already committed for it, which is how the method was checked.Not verified
.editorconfig.