Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: change github actions from tags to SHAs #18

Merged

Conversation

jmeridth
Copy link
Contributor

@jmeridth jmeridth commented Jun 5, 2024

It is more secure. SHAs can't change out from underneath you, tags can

  • change GitHub Actions to use SHAs instead of tags
    • Why?
      • To prevent supply chain attack. Tags can move. They are mutable. SHAs are not.
    • used frizbee - ran frizbee ghactions -d .github/workflows locally - also fixes formatting

Checklist:

  • I have updated the necessary documentation
  • I have signed off all my commits as required by DCO
  • My build is green

It is more secure.  SHAs can't change out from underneath you, tags can

- [x] change GitHub Actions to use SHAs instead of tags
  - used [frizbee](https://github.com/stacklok/frizbee)
    - ran `frizbee ghactions -d .github/workflows` locally
    - also fixes formatting

Signed-off-by: jmeridth <[email protected]>
@jmeridth jmeridth requested a review from a team as a code owner June 5, 2024 22:17
@jmeridth
Copy link
Contributor Author

jmeridth commented Jun 6, 2024

@jhollinger thank you for the approval. Can you please merge? I'm unable. 😄

@bmanuel bmanuel merged commit dd86f4e into procore-oss:main Jun 6, 2024
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants