4 ms·
Even with a lock file, the action can download and execute arbitrary code from the internet.
by Munksgaard 5mo ago
Even with a lock file, the action can download and execute arbitrary code from the internet.
- shykes 5mo agoIt would be cool if CI could inject a platform-wide lockfile into every remote download or lookup made by your scripts. So if you pull a container or git tag, the CI platform would automatically ensure that the exact digest downloaded is controlled by a lock file that you can inspect, check in, etc.