You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@daffodil.apache.org by "Steve Lawrence (Jira)" <ji...@apache.org> on 2024/02/29 18:26:00 UTC

[jira] [Resolved] (DAFFODIL-2881) Pin github actions to commit hash instead of tags

     [ https://issues.apache.org/jira/browse/DAFFODIL-2881?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Steve Lawrence resolved DAFFODIL-2881.
--------------------------------------
    Fix Version/s: 3.7.0
       Resolution: Fixed

Fixed in commit d5e084c34abbd337d0951a6d33460465e38692e8

> Pin github actions to commit hash instead of tags
> -------------------------------------------------
>
>                 Key: DAFFODIL-2881
>                 URL: https://issues.apache.org/jira/browse/DAFFODIL-2881
>             Project: Daffodil
>          Issue Type: Bug
>          Components: Infrastructure
>            Reporter: Steve Lawrence
>            Assignee: Steve Lawrence
>            Priority: Minor
>             Fix For: 3.7.0
>
>
> Github actions should be pinned to a commit hash instead of a version to prevent malicious actors or just accidental breaking of builds if tags are renamed/deleted:
> https://blog.rafaelgss.dev/why-you-should-pin-actions-by-commit-hash



--
This message was sent by Atlassian Jira
(v8.20.10#820010)