-
Notifications
You must be signed in to change notification settings - Fork 228
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add deploy key functionality #115
Conversation
You can, but this does not make sense in GitHub Actions, because you can always use commit SHA as a version identifier.
Additionally, if you create a fork and push a commit into it, you can get each commit fork through the upstream repository: https://github.com/torvalds/linux/tree/8bcab0346d4fcf21b97046eb44db8cf37ddd6da0 |
In practice, even some security-sensitive people recommend using SHA commit versions in GitHub Actions, because the tags do not guarantee immutability (you can delete the tag and create a new one, in effect injecting the code in all consumer of actions). |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM 👍🏼 Could you rebase & self-merge?
The corresponding PR adds in general support for the SSH Key functionality and solve the following issue.
@ad-m Could we test the first version via a dev release? I want to consume the new dev release via this test job to validate the functionality.