crickets-and-comb / crickets-and-comb/reference_package
Pin third-party actions to commit SHAs
Open
bug
help wanted
- Dominant language
- Python
- Stars
- 1
- Forks
- 2
- PR merge metrics
- No merged PRs in 30d
Description
Sounds like best practice is not to simply pin to a version to get the latest patch updates, but to pin to a specific commit SHA.
For all calls to third-party actions, pin to a specific SHA, copied directly from the action source.
Kaleb: Set up a periodic review of SHAs or ensure that security alerts will issue for specific SHAs.
Contributor guide
Assessment
This issue has not been assessed yet.