[I] Use a full 40-character SHA in the workflow-security-audit pinning example [magpie]

["justinmclean (via GitHub)" <gi...@apache.org>]

justinmclean opened a new issue, #952:
URL: https://github.com/apache/magpie/issues/952

   ## Summary
   
   The remediation example in `skills/workflow-security-audit/SKILL.md` pins a
   GitHub Action to a 39-character SHA. A git SHA-1 is 40 hex characters, so the
   example in the rule that teaches SHA-pinning does not itself parse as a SHA.
   
   ## Background
   
   The unpinned-actions rule tells a maintainer to replace a floating tag with a
   full commit SHA, and shows `actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af68`
   as the shape to copy. That value is 39 characters. GitHub rejects a short or
   malformed SHA in `uses:`, so anyone copying the example as a template and
   adjusting it by hand can end up with a workflow that fails to resolve.
   
   The rule's advice is right; only the example is wrong. It is worth fixing
   precisely because this is the rule people copy from.
   
   ## Where to look
   
   - `skills/workflow-security-audit/SKILL.md` line 238 - the example.
   - `.github/workflows/` - workflows here already pin to real 40-character SHAs.
   - `grep -rn '364c9af68' tools/skill-evals/` - check no fixture asserts on it.
   
   ## Acceptance criteria
   
   - [ ] The example SHA is exactly 40 hex characters.
   - [ ] It is a real commit on the action referenced, not a made-up string.
   - [ ] Any eval fixture referencing the old value is updated.
   - [ ] `skill-and-tool-validate` passes.
   
   ## Estimated effort
   
   ~30 minutes for someone new to the codebase.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Use a full 40-character SHA in the workflow-security-audit pinning example [magpie]

["Shaurya2k06 (via GitHub)" <gi...@apache.org>]

Shaurya2k06 commented on issue #952:
URL: https://github.com/apache/magpie/issues/952#issuecomment-5090267846

   Hey @justinmclean , happy to take this one up!
   cc @justinmclean 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Use a full 40-character SHA in the workflow-security-audit pinning example [magpie]

["justinmclean (via GitHub)" <gi...@apache.org>]

justinmclean commented on issue #952:
URL: https://github.com/apache/magpie/issues/952#issuecomment-5090344537

   All yours!


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Use a full 40-character SHA in the workflow-security-audit pinning example [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk closed issue #952: Use a full 40-character SHA in the workflow-security-audit pinning example
URL: https://github.com/apache/magpie/issues/952


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org