Skip to content

[Feature]: Currently the third party actions uses tag instead of commit hash #615

Description

@antedotee

Consisely describe the feature.

Using tag may result in security breaches, because the tag is same and there is a possibility that someone push malicious code into the github action and since we are using the same tag, our repo may end up using that malicious code, which may result in breaches.

The solution would be to enforce commit hash, ideally at repository level.
In case anyone is interested in how to do it, I am attaching a github article for this: https://docs.github.com/actions/reference/security/secure-use#using-third-party-actions

Upload screenshots

Add screenshots or proposed mockups (optional).

LLM Policy

  • This issue is human-written, and folow up comments will also be human-written

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions