diff options
| author | naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com> | 2022-03-18 23:56:02 +0000 |
|---|---|---|
| committer | naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com> | 2022-03-28 19:00:16 +0000 |
| commit | 1821eb3837a81bf666ed87e5ccb3da4e190a9aba (patch) | |
| tree | bd9f7fea260a1c602d0c9a77406eac4f3a67b0c2 /.github/workflows/stale.yml | |
| parent | c2eae35c606382418c6e2ce57c4ab874f1975f21 (diff) | |
| download | podman-1821eb3837a81bf666ed87e5ccb3da4e190a9aba.tar.gz podman-1821eb3837a81bf666ed87e5ccb3da4e190a9aba.tar.bz2 podman-1821eb3837a81bf666ed87e5ccb3da4e190a9aba.zip | |
Pin actions to a full length commit SHA
- Pinned actions by SHA https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies
- Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
>Pin actions to a full length commit SHA
>Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
Also dependabot supports upgrades based on SHA.
Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com>
Diffstat (limited to '.github/workflows/stale.yml')
| -rw-r--r-- | .github/workflows/stale.yml | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index d6f92873e..b340c9238 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -7,13 +7,19 @@ on: schedule: - cron: "0 0 * * *" +permissions: + contents: read + jobs: stale: + permissions: + issues: write # for actions/stale to close stale issues + pull-requests: write # for actions/stale to close stale PRs runs-on: ubuntu-latest steps: - - uses: actions/stale@v3 + - uses: actions/stale@98ed4cb500039dbcccf4bd9bedada4d0187f2757 # v3 with: repo-token: ${{ secrets.GITHUB_TOKEN }} stale-issue-message: 'A friendly reminder that this issue had no activity for 30 days.' |