4 ms·
Doesn't a single compromised action in the chain cause the whole to be fucked? Pinning the top level doesn't prevent any spread.
by franktankbank 7mo ago
Doesn't a single compromised action in the chain cause the whole to be fucked? Pinning the top level doesn't prevent any spread.
- teaearlgraycold 7mo agoMight want to vendor everything?
- franktankbank 7mo agoI don't know what this means in this context.
- teaearlgraycold 7mo agoMake copies of the entire GitHub action dependency tree.
- lijok 7mo agoThat’s the way to go indeed. We’ve done it, not difficult, just a bit of gruntwork to keep them updated when needed