diff options
| author | naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com> | 2022-03-18 23:56:02 +0000 |
|---|---|---|
| committer | naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com> | 2022-03-28 19:00:16 +0000 |
| commit | 1821eb3837a81bf666ed87e5ccb3da4e190a9aba (patch) | |
| tree | bd9f7fea260a1c602d0c9a77406eac4f3a67b0c2 /.github/workflows/issue-labeler.yml | |
| parent | c2eae35c606382418c6e2ce57c4ab874f1975f21 (diff) | |
| download | podman-1821eb3837a81bf666ed87e5ccb3da4e190a9aba.tar.gz podman-1821eb3837a81bf666ed87e5ccb3da4e190a9aba.tar.bz2 podman-1821eb3837a81bf666ed87e5ccb3da4e190a9aba.zip | |
Pin actions to a full length commit SHA
- Pinned actions by SHA https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies
- Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
>Pin actions to a full length commit SHA
>Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
Also dependabot supports upgrades based on SHA.
Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com>
Diffstat (limited to '.github/workflows/issue-labeler.yml')
| -rw-r--r-- | .github/workflows/issue-labeler.yml | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/.github/workflows/issue-labeler.yml b/.github/workflows/issue-labeler.yml index ee9785d23..18fff7f7c 100644 --- a/.github/workflows/issue-labeler.yml +++ b/.github/workflows/issue-labeler.yml @@ -7,7 +7,7 @@ jobs: triage: runs-on: ubuntu-latest steps: - - uses: github/issue-labeler@v2.0 + - uses: github/issue-labeler@3ae0e4623c1fda729347ae0d8f1c2e52302ef4c6 # v2.0 with: repo-token: "${{ secrets.GITHUB_TOKEN }}" configuration-path: .github/issue-labeler.yml |