github-community-projects / private-mirrors

A GitHub App that allows you to contribute upstream using private mirrors of public projects
MIT License
119 stars 12 forks source link

chore: Pin actions to SHAs for security and reproducibility #165

Closed zkoppert closed 2 months ago

zkoppert commented 2 months ago

Pull Request

Proposed Changes

This pull request pins the versions of GitHub actions used in the project's workflows. The versions of these actions have been pinned to specific commits for increased stability and security. Version tags can be moved and create unpredictable results, so pinning to a specific commit ensures that the same version of the action is used every time the workflow runs.

Readiness Checklist

Author/Contributor

Reviewer