Pin third party action to hash

julia-actions / cache

A shortcut action to cache Julia artifacts, packages, and registries.

MIT License

38 stars 8 forks source link

Pin third party action to hash #106

Closed SaschaMann closed 6 months ago

SaschaMann commented 6 months ago

Third party actions should never not be pinned to a hash. Otherwise, in case the action repo is taken over by a malicious actor, they can change what runs in all of the workflows that julia-actions/cache is used in as well. Pinning to a hash prevents that.