chore: pin external github ations to commit SHA #9417
Conversation
There was a problem hiding this comment.
Pull request overview
This PR enhances the security posture of the GitHub workflows by pinning the ncipollo/release-action external action to a specific commit SHA. This follows the established security best practice in the repository where external GitHub actions (those not from the official actions/ namespace) are pinned to immutable commit hashes to prevent supply chain attacks through compromised action versions.
Key Changes
- Pinned
ncipollo/release-actionfrom version tagv1to commit SHA440c8c1cb0ed28b9f43e4d1d670870f059653174
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.
|
|
||
| - name: Create Tag and Release | ||
| uses: ncipollo/release-action@v1 | ||
| uses: ncipollo/release-action@440c8c1cb0ed28b9f43e4d1d670870f059653174 # v1 |
There was a problem hiding this comment.
Remove trailing space after the version comment. The comment should be # v1 not # v1 to maintain consistency with other pinned actions in this file.
| uses: ncipollo/release-action@440c8c1cb0ed28b9f43e4d1d670870f059653174 # v1 | |
| uses: ncipollo/release-action@440c8c1cb0ed28b9f43e4d1d670870f059653174 # v1 |
No description provided.