4 ms·
I am surprised nobody here mentionned immutable github actions that are coming [1]. Been waiting for them since the issue was open in 2022. This would have sign
by Sytten 2y ago
I am surprised nobody here mentionned immutable github actions that are coming [1]. Been waiting for them since the issue was open in 2022. This would have significantly reduce impact and hopefully github will get it over the finish line.
I always fork my actions or at least use a commit hash.
[1] https://github.com/features/preview/immutable-actions https://github.com/features/preview/immutable-actions
- ricardobeat 2y agoI thought actions were already immutable and published to a registry, not fetched directly from their repo. TIL. Go also uses tags for module versioning, and while go.mod or package-lock.json stop this attack from reaching existing consumers, allowing remapping of all versions to the compromised one still expands the impact surface a lot. GitHub should offer a “immutable tags” setting for repos like these.
- deleted 2y ago[deleted]