3 ms·
> Actions reduce workflow steps by providing reusabe[sic] “code” for common tasks. To run an action, you include the uses keyword pointing to a GitHub repo with
by nyanpasu64 5y ago
> Actions reduce workflow steps by providing reusabe[sic] “code” for common tasks. To run an action, you include the uses keyword pointing to a GitHub repo with the pattern {owner}/{repo}@{ref} or {owner}/{repo}/{path}@{ref} if it’s in a subdirectory. A ref can be a branch, tag, or SHA.
Aside from the typo, I wonder how many packages could be backdoored at once, if an action maintainer went rogue, seeing as there's no pinning for actions by default, and (according to https://github.com/msys2/setup-msys2/blob/main/HACKING.md https://github.com/msys2/setup-msys2/blob/main/HACKING.md) moving a tag is the default way to push updates to an action. (Interestingly get-cmake/run-cmake/run-vcpkg are all operated by the same person.)
- macintoshpie 5y agoOops thanks for the catch
- patcon 5y agoDef a real concern. If anyone is interested to mitigate it yourself, these are helpful :) https://docs.github.com/en/actions/creating-actions/about-custom-actions#using-a-commits-sha-for-release-management https://docs.github.com/en/actions/creating-actions/about-cu... https://github.com/dependabot/dependabot-core/issues/2835 https://github.com/dependabot/dependabot-core/issues/2835 https://github.com/zgosalvez/github-actions-ensure-sha-pinned-actions https://github.com/zgosalvez/github-actions-ensure-sha-pinne... https://github.com/timmeinerzhagen/dependabot-sha-comment-action https://github.com/timmeinerzhagen/dependabot-sha-comment-ac...
- bewuethr 5y agoYou can pin to a commit SHA, and that's what the docs recommend as the "safest for stability and security": https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsuses https://docs.github.com/en/actions/using-workflows/workflow-...