3 ms·
Yes, true, but at least the fire won't spread through this one point. Hopefully all of your upstreams can be persuaded to pin also.
by imglorp 7mo ago
Yes, true, but at least the fire won't spread through this one point. Hopefully all of your upstreams can be persuaded to pin also.
- franktankbank 7mo agoDoesn't a single compromised action in the chain cause the whole to be fucked? Pinning the top level doesn't prevent any spread.
- teaearlgraycold 7mo agoMight want to vendor everything?
- franktankbank 7mo agoI don't know what this means in this context.
- teaearlgraycold 7mo agoMake copies of the entire GitHub action dependency tree.
- lijok 7mo agoThat’s the way to go indeed. We’ve done it, not difficult, just a bit of gruntwork to keep them updated when needed