Skip to content
This repository has been archived by the owner on Jun 13, 2024. It is now read-only.

Commit

Permalink
[StepSecurity] ci: Harden GitHub Actions (#937)
Browse files Browse the repository at this point in the history
## Summary

This pull request is created by [Secure
Repo](https://app.stepsecurity.io/securerepo) at the request of
@guidezpl. Please merge the Pull Request to incorporate the requested
changes. Please tag @guidezpl on your message if you have any questions
related to the PR. You can also engage with the
[StepSecurity](https://github.com/step-security) team by tagging
@step-security-bot.


## Security Fixes

### Pinned Dependencies

GitHub Action tags and Docker tags are mutatble. This poses a security
risk. GitHub's Security Hardening guide recommends pinning actions to
full length commit.

- [GitHub Security
Guide](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions)
- [The Open Source Security Foundation (OpenSSF) Security
Guide](https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies)


## Feedback
For bug reports, feature requests, and general feedback; please create
an issue in
[step-security/secure-repo](https://github.com/step-security/secure-repo).
To create such PRs, please visit https://app.stepsecurity.io/securerepo.


Signed-off-by: StepSecurity Bot <[email protected]>

Signed-off-by: StepSecurity Bot <[email protected]>
  • Loading branch information
step-security-bot authored Apr 26, 2023
1 parent dd7148e commit 908b276
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions .github/workflows/release_deploy_windows.yml
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,11 @@ jobs:
runs-on: windows-latest

steps:
- uses: actions/checkout@v3
- uses: subosito/flutter-action@v2
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
- uses: subosito/flutter-action@48cafc24713cca54bbe03cdc3a423187d413aafa # v2.10.0

- uses: dart-lang/setup-dart@9a04e6d73cca37bd455e0608d7e5092f881fd603
- uses: microsoft/setup-msstore-cli@v1
- uses: microsoft/setup-msstore-cli@3b2ec9136230357ce9abc02b9d056626fb248d3f # v1

# Instructions on obtaining these secrets can be found at https://github.com/marketplace/actions/windows-store-publish#obtaining-your-credentials
- name: Configure MS CLI
Expand Down

0 comments on commit 908b276

Please sign in to comment.