I work on an open source security project (Frizbee) that can automatically pin GitHub Actions to digests (instead of floating tags).
The Frizbee team is trying to spread the word to open source maintainers about the need for this, because pinning your actions to commit hashes is the only way to get an immutable pointer to a specific revision. If an action's source code repo is compromised by a malicious actor, you'll still be referencing a known-good version and your project won't be at risk.
The following PR pins your actions to their commit hash and it was done using the frizbee CLI. Frizbee also appends a comment so you can easily see which version this digest corresponds to.
Note that Dependabot supports updating pinned actions and will continue to update them.
If you liked it and also want to keep this consistent in case you add more unpinned actions in future, there's a frizbee-action which you can use to help automate this.
Hey there 👋
I work on an open source security project (Frizbee) that can automatically pin GitHub Actions to digests (instead of floating tags).
The Frizbee team is trying to spread the word to open source maintainers about the need for this, because pinning your actions to commit hashes is the only way to get an immutable pointer to a specific revision. If an action's source code repo is compromised by a malicious actor, you'll still be referencing a known-good version and your project won't be at risk.
The following PR pins your actions to their commit hash and it was done using the frizbee CLI. Frizbee also appends a comment so you can easily see which version this digest corresponds to.
Note that Dependabot supports updating pinned actions and will continue to update them.
If you liked it and also want to keep this consistent in case you add more unpinned actions in future, there's a frizbee-action which you can use to help automate this.
Thanks!