Hey, I'm back (see #1224) with another security suggestion!
Docker image tags are mutable and can therefore be modified by malicious actors. A solution is to pin the image to a hash instead. This ensures the image will always do what you expect.
The images can be kept up-to-date with dependabot. Whenever a new version of an Action is released, you'll receive a PR updating its hash (see my fork's PR for an example).
I'll send a PR along with this issue to pin the images and set up dependabot to keep an eye on them.
Hey, I'm back (see #1224) with another security suggestion!
Docker image tags are mutable and can therefore be modified by malicious actors. A solution is to pin the image to a hash instead. This ensures the image will always do what you expect.
The images can be kept up-to-date with dependabot. Whenever a new version of an Action is released, you'll receive a PR updating its hash (see my fork's PR for an example).
I'll send a PR along with this issue to pin the images and set up dependabot to keep an eye on them.