4 ms·
No the "v4" tag gets updated from v4.1 to v4.2 etc as those minor versions are released. They are branches, functionally.
by remram 2y ago
No the "v4" tag gets updated from v4.1 to v4.2 etc as those minor versions are released. They are branches, functionally.
- harrisi 2y agoWow, thank you (and the other person that pointed this out to me). That's madness.
- semiquaver 2y agoYou can pin actions to a git sha to prevent this but people generally do not. Action authors would prefer their updates be picked up automatically.
- werrett 2y agoExactly. And that's what happened here -- the bad actor changed all of those version tags to point to their malicious commit. See https://github.com/tj-actions/changed-files/tags https://github.com/tj-actions/changed-files/tags All the tags point to commit `^0e58ed8` https://github.com/tj-actions/changed-files/commit/0e58ed8671d6b60d0890c21b07f8835ace038e67#diff-3d2b59189eeedc2d428ddd632e97658fe310f587f7cb63b01f9b98ffc11c0197R2999 https://github.com/tj-actions/changed-files/commit/0e58ed867...
- diggan 2y agoCorrect me if I'm wrong, but you would be able to prevent this specific issues with the "Rules" in order to block updates of tags; https://github.blog/news-insights/product-news/github-repository-rules-are-now-generally-available/ https://github.blog/news-insights/product-news/github-reposi...
- sestep 2y agoYeah but no GitHub Action is going to do this because updating tags is the de facto mechanism for releasing patches for those repositories.