4 ms·
Aren't GitHub action "packages" designate by a single major version? Something like checkout@v4, for example. I thought that that designated a single release as
by harrisi 2y ago
Aren't GitHub action "packages" designate by a single major version? Something like checkout@v4, for example. I thought that that designated a single release as v4 which will not be updated?
I'm quite possibly wrong, since I try to avoid them as much as I can, but I mean.. wow I hope I'm not.
- remram 2y agoNo the "v4" tag gets updated from v4.1 to v4.2 etc as those minor versions are released. They are branches, functionally.
- harrisi 2y agoWow, thank you (and the other person that pointed this out to me). That's madness.
- semiquaver 2y agoYou can pin actions to a git sha to prevent this but people generally do not. Action authors would prefer their updates be picked up automatically.
- werrett 2y agoExactly. And that's what happened here -- the bad actor changed all of those version tags to point to their malicious commit. See https://github.com/tj-actions/changed-files/tags https://github.com/tj-actions/changed-files/tags All the tags point to commit `^0e58ed8` https://github.com/tj-actions/changed-files/commit/0e58ed8671d6b60d0890c21b07f8835ace038e67#diff-3d2b59189eeedc2d428ddd632e97658fe310f587f7cb63b01f9b98ffc11c0197R2999 https://github.com/tj-actions/changed-files/commit/0e58ed867...
- diggan 2y agoCorrect me if I'm wrong, but you would be able to prevent this specific issues with the "Rules" in order to block updates of tags; https://github.blog/news-insights/product-news/github-repository-rules-are-now-generally-available/ https://github.blog/news-insights/product-news/github-reposi...
- sestep 2y agoYeah but no GitHub Action is going to do this because updating tags is the de facto mechanism for releasing patches for those repositories.