Security hardening of third-party GitHub actions - Githubissues

dequelabs / axe-linter-action

A GitHub Action to lint for any accessibility issues in your pull requests.

Mozilla Public License 2.0

8 stars 6 forks source link

Security hardening of third-party GitHub actions #26

Open anastasialanz opened 11 months ago

anastasialanz commented 11 months ago

This is a risk in using third-party GitHub actions so the following practices should be taken:

Pin actions to a full length commit SHA
Audit the source code of the action
Pin actions to a tag only if you trust the creator

https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions

Suggestions

mikefarah/yq@master can be updated to use a commit sha instead of master