3 ms·

There are downsides to it though. You... - lose vulnerability alerts - increase maintenance overhead - take on all that for value that will go to 0 once Immutab

by mmarian 6mo ago

There are downsides to it though. You... - lose vulnerability alerts - increase maintenance overhead - take on all that for value that will go to 0 once Immutable Releases gets widely adopted I wrote a couple of blog posts on it, and a makeshift way of tackling that https://developerwithacat.com/blog/202604/github-actions-supply-chain-commit/ https://developerwithacat.com/blog/202604/github-actions-sup...

woodruffw 6mo ago
You lose vulnerability alerts, on GitHub. This is a (ridiculous, IMO) platform limitation that GitHub could lift by applying more engineering time to Dependabot and Dependabot's integrated security alerts feature. zizmor (and other tools) correctly recovers vulnerability information for SHA-pinned actions[1]. [1]: https://docs.zizmor.sh/audits/#known-vulnerable-actions https://docs.zizmor.sh/audits/#known-vulnerable-actions
- mmarian 6mo ago
  I agree, silly limitation. On zizmor, there's no mention of coverage on commit SHA the section you've linked, nor in the entire page when I do Ctrl+F. Is there anything I'm missing?
  - woodruffw 6mo ago
    Oh, I guess I didn't document it explicitly. My bad! You can see it in the source here[1]. [1]: https://github.com/zizmorcore/zizmor/blob/db5ed6b3bb445848a8e7b1920a12c9c664d08a33/crates/zizmor/src/audit/known_vulnerable_actions.rs#L84-L98 https://github.com/zizmorcore/zizmor/blob/db5ed6b3bb445848a8...
    - mmarian 6mo ago
      Oh, nice, will look into it, thanks! Let me know if you're aware of any other tools that do this. I had a look before and couldn't find any.
baby_souffle 6mo ago
The maintenance aspect is relatively straightforward to automate. Renovate handles this well. Ratchet and pinact can also be used
- mmarian 6mo ago
  I mention in the posts the problem with the likes of Renovate. Auto merging is equivalent to semantic versioning. You have to properly vet the influx of updates, and that unfortunately won't work in practice.

by mmarian 6mo ago

woodruffw 6mo ago

You lose vulnerability alerts, on GitHub. This is a (ridiculous, IMO) platform limitation that GitHub could lift by applying more engineering time to Dependabot and Dependabot's integrated security alerts feature. zizmor (and other tools) correctly recovers vulnerability information for SHA-pinned actions[1]. [1]: https://docs.zizmor.sh/audits/#known-vulnerable-actions https://docs.zizmor.sh/audits/#known-vulnerable-actions

mmarian 6mo ago
I agree, silly limitation. On zizmor, there's no mention of coverage on commit SHA the section you've linked, nor in the entire page when I do Ctrl+F. Is there anything I'm missing?
- woodruffw 6mo ago
  Oh, I guess I didn't document it explicitly. My bad! You can see it in the source here[1]. [1]: https://github.com/zizmorcore/zizmor/blob/db5ed6b3bb445848a8e7b1920a12c9c664d08a33/crates/zizmor/src/audit/known_vulnerable_actions.rs#L84-L98 https://github.com/zizmorcore/zizmor/blob/db5ed6b3bb445848a8...
  - mmarian 6mo ago
    Oh, nice, will look into it, thanks! Let me know if you're aware of any other tools that do this. I had a look before and couldn't find any.

baby_souffle 6mo ago

The maintenance aspect is relatively straightforward to automate. Renovate handles this well. Ratchet and pinact can also be used

mmarian 6mo ago
I mention in the posts the problem with the likes of Renovate. Auto merging is equivalent to semantic versioning. You have to properly vet the influx of updates, and that unfortunately won't work in practice.