Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Pin untrusted Github Action to a commit hash #2279

Merged
merged 1 commit into from
Aug 28, 2023
Merged

Pin untrusted Github Action to a commit hash #2279

merged 1 commit into from
Aug 28, 2023

Conversation

JoshMock
Copy link
Member

Infosec recommends third-party actions that are maintained by individuals and not on behalf of trusted orgs like GitHub should be pinned to a specific commit.

pquentin
pquentin approved these changes Aug 25, 2023
View reviewed changes
Copy link
Member

@pquentin pquentin left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! LGTM.

In the future we could ask dependabot to update when the major version changes or a vulnerability is found. It even understand commit references like this.

@JoshMock JoshMock merged commit e4a881c into main Aug 28, 2023
15 checks passed
@JoshMock JoshMock deleted the action-lockdown branch August 28, 2023 15:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@pquentin pquentin pquentin approved these changes

@picandocodigo picandocodigo picandocodigo approved these changes

@ezimuel ezimuel Awaiting requested review from ezimuel

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@JoshMock @pquentin @picandocodigo