chainguard-dev / chainguard-dev/actions
GitHub Actions should be referenced by SHA not tag
Open
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 173
- Forks
- 83
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 11
Description
Just like how container images should be referenced by digest, GitHub actions should be referenced by SHA and not tag. Dependabot can handle this pattern including keeping the tag used next to the SHA as a comment.
jobs:
test:
steps:
- name: Checkout
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Search the repository's reusable workflow files for GitHub Actions references using tags. Update each action reference to a commit SHA while preserving the version tag as a comment, following the example in the issue. Done means the workflow references are SHA-pinned and retain readable version comments.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions
- Domain
- ci-cd, security
- Issue type
- Refactor
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100