Hash-pin workflow Actions #787
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Pedro Kaj Kjellerup Nacht <pnacht@google.com>
Signed-off-by: Pedro Kaj Kjellerup Nacht <pnacht@google.com>
|
Trying to get more context here. Is this a mandatory policy update to use workflow actions from Google internally (if so, is there a link for it; feel free to send it to yelouis@)? I can see that there is some mentioning at https://opensource.google/documentation/reference/github/services#actions, but it would be great to see if this is actually a policy. Thanks! |
Codecov Report
@@ Coverage Diff @@
## main #787 +/- ##
=======================================
Coverage 66.99% 66.99%
=======================================
Files 45 45
Lines 9862 9862
=======================================
Hits 6607 6607
Misses 2795 2795
Partials 460 460 |
|
LGTM |
Louis-Ye
approved these changes
Jun 28, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #786.
As described in the issue, this PR hash-pins all workflow Actions to protect the project from supply-chain attacks.
I've also set up dependabot to monitor the GitHub Actions. Whenever a new version is released, you'll receive a PR updating the Action's hash and the associated version comment.