exercism / exercism/problem-specifications
CI: Add a per-track workflow that checks all GHAs are pinned to a SHA
Ouverte
- Langage dominant
- Ruby
- Étoiles
- 358
- Forks
- 563
- Merge moyen
- 18 h 41 min
- PR mergées (30 j)
- 2
Description
As per:
https://github.com/exercism/problem-specifications/pull/1722/files#diff-4d2cace23cf1ea1094ebdad9ef0dfa2e93c9e23056b2265af6ddec0e5899c932R75
Can we enforce (via CI) that all GHA scripts are pinned to shas?
This is a real attack vector for us for repos with tokens (which many repos now have), as someone could change the script and spam our AWS account and cost us a lot of money.
Guide de contribution
Aucun guide de contribution indexé pour ce dépôt
Évaluation
Cette issue n'a pas encore été évaluée.