Skip to content

Commit

Permalink
chore: pin docker buildx action
Browse files Browse the repository at this point in the history
  • Loading branch information
@drcgjung
drcgjung committed Nov 22, 2024
1 parent fc14ff5 commit b226c11
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion .github/workflows/build.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -102,7 +102,7 @@ jobs:

# Needed to create multi-platform image
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v2
uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 (v3.7.1)

Check warning on line 105 in .github/workflows/build.yml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA 

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning

Code scanning / KICS

Unpinned Actions Full Length Commit SHA Warning

Action is not pinned to a full length commit SHA.

# Enable deployment access (on demand or main branch and version tags only)
- name: Login to GitHub Container Registry
Expand Down

0 comments on commit b226c11

Please sign in to comment.