diff options
| author | naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com> | 2022-03-18 23:56:02 +0000 |
|---|---|---|
| committer | naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com> | 2022-03-28 19:00:16 +0000 |
| commit | 1821eb3837a81bf666ed87e5ccb3da4e190a9aba (patch) | |
| tree | bd9f7fea260a1c602d0c9a77406eac4f3a67b0c2 /.github/workflows/pr-title.yml | |
| parent | c2eae35c606382418c6e2ce57c4ab874f1975f21 (diff) | |
| download | podman-1821eb3837a81bf666ed87e5ccb3da4e190a9aba.tar.gz podman-1821eb3837a81bf666ed87e5ccb3da4e190a9aba.tar.bz2 podman-1821eb3837a81bf666ed87e5ccb3da4e190a9aba.zip | |
Pin actions to a full length commit SHA
- Pinned actions by SHA https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies
- Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
>Pin actions to a full length commit SHA
>Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
Also dependabot supports upgrades based on SHA.
Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com>
Diffstat (limited to '.github/workflows/pr-title.yml')
| -rw-r--r-- | .github/workflows/pr-title.yml | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml index e00b8465c..2b57392ce 100644 --- a/.github/workflows/pr-title.yml +++ b/.github/workflows/pr-title.yml @@ -11,7 +11,7 @@ jobs: update_pr: runs-on: ubuntu-latest steps: - - uses: tzkhan/pr-update-action@v2 + - uses: tzkhan/pr-update-action@bbd4c9395df8a9c4ef075b8b7fe29f2ca76cdca9 # v2 with: repo-token: "${{ secrets.GITHUB_TOKEN }}" base-branch-regex: '^(?!master).*$' |