Currently, we're inconsistently referencing third-party GitHub Actions by Git tags, Git branches and the Git commit hash.
Git tags and Git branches can be re-pointed to a different Git commit hash without our explicit knowledge. Hence, this poses a security risk as a malicious GitHub Action that we depend on can go under the radar without our knowledge.
We should standardise on referencing by Git commit hash.
Renovate currently handles keeping the GitHub Actions up-to-date. It supports updating Git commit hash while following the Git tags:
Currently, we're inconsistently referencing third-party GitHub Actions by Git tags, Git branches and the Git commit hash.
Git tags and Git branches can be re-pointed to a different Git commit hash without our explicit knowledge. Hence, this poses a security risk as a malicious GitHub Action that we depend on can go under the radar without our knowledge.
We should standardise on referencing by Git commit hash.
Renovate currently handles keeping the GitHub Actions up-to-date. It supports updating Git commit hash while following the Git tags:
The syntax would be either of the following:
Loosely-related to https://github.com/loopbackio/security/issues/25 (Part of OpenSSF Scorecard check).
GitHub repositories