search

auth0 / go-jwt-middleware

A Middleware for Go Programming Language to check for JWTs on HTTP requests
MIT License
1.08k stars 205 forks source link

chore(security): Pin workflow actions to commit SHAs #210

Closed evansims closed 1 year ago

evansims commented 1 year ago

This PR pins the Templum/govulncheck-action, golangci/golangci-lint-action, and codecov/codecov-action third-party actions to the full-length commit SHAs for their most recent releases.

Pinning an action to a full-length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository. docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions

codecov-commenter commented 1 year ago

Codecov Report

Patch and project coverage have no change.

Comparison is base (dbff9c6) 94.78% compared to head (96ada29) 94.78%.

Additional details and impacted files ```diff @@ Coverage Diff @@ ## master #210 +/- ## ======================================= Coverage 94.78% 94.78% ======================================= Files 7 7 Lines 307 307 ======================================= Hits 291 291 Misses 12 12 Partials 4 4 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Do you have feedback about the report comment? Let us know in this issue.