search

actions / publish-immutable-action

A GitHub Action used for publishing an Action to ghcr.io as an OCI container.
MIT License
42 stars 7 forks source link

Secure actions execution context #181

Closed conorsloan closed 3 months ago

conorsloan commented 3 months ago

Where possible, we want to get our information from the most secure place possible, and make every effort to avoid any step of the process that could be interfered with by a bad actor.

The changes we're making here are as follows:

  1. Grab all information from the github context rather than env vars where possible, since env vars can easily be changed
  2. Fix up some error reporting around our git checkout checks - this should provide more context if we fail checking the currently checked out sha matches the github ref tag's associated checkout.