3 ms·
This is rehashing (no pun intended) a very long-discussed issue about versioning. Your post also contradicts itself. > SHA `11bd71901bbe5b1630ceea73d27597364c9
by junon 2y ago
This is rehashing (no pun intended) a very long-discussed issue about versioning. Your post also contradicts itself.
> SHA `11bd71901bbe5b1630ceea73d27597364c9af683` - That means absolutely nothing to a human being
> Presumably it would be wise to check the SHA as well to ensure no changes have taken place maliciously
That's exactly why the first one happens so often - I've checked the dependency at that version, and I want to make sure I only get that version, as spoofing sha's in a Git context is not part of my threat model.
- ThinkBeat 2y agoThat is true. In the post I am replying to the idea was SHA `11bd71901bbe5b1630ceea73d27597364c9af683 as what the script contains as a reference. While i would advocate hashicorp/setup-terraform@v3-2025-03-26-15-01 Hash: `11bd71901bbe5b1630ceea73d27597364c9af683` I consider it easier to deal with, .