diff options
| author | Naveen <172697+naveensrinivasan@users.noreply.github.com> | 2022-03-29 07:08:01 -0500 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-03-29 21:08:01 +0900 |
| commit | 19af8fc7d8f5b4dcf8730ea0b5826bad9fac2dc4 (patch) | |
| tree | be1e06f0d1f83c7de0299396aee83e6750994f5f /.github/workflows/linux.yml | |
| parent | a06671b47f0284733c7edf7dae8f22f9758c8393 (diff) | |
| download | fzf-19af8fc7d8f5b4dcf8730ea0b5826bad9fac2dc4.tar.gz | |
Pin actions to a full length commit SHA (#2765)
- Pinned actions by SHA https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies
- Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
>Pin actions to a full length commit SHA
>Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
Also, dependabot supports upgrade based on SHA.
Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com>s
Diffstat (limited to '.github/workflows/linux.yml')
| -rw-r--r-- | .github/workflows/linux.yml | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index 3558a83a..68bb0ed5 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -8,6 +8,9 @@ on: branches: [ master ] workflow_dispatch: +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest @@ -15,17 +18,17 @@ jobs: matrix: go: [1.14, 1.16] steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2 with: fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@v2 + uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 # v2 with: go-version: ${{ matrix.go }} - name: Setup Ruby - uses: ruby/setup-ruby@v1.62.0 + uses: ruby/setup-ruby@5aaa89ff0d7bb9c02d18c0008a98d24f38acbbbb # v1.62.0 with: ruby-version: 3.0.0 |