Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CI: pin GitHub Actions workflows #110

Merged
merged 1 commit into from
Nov 21, 2023
Merged

Conversation

ErikSchierboom
Copy link
Member

This PR updates GitHub Actions workflows to a specific version.
This ensures that the workflow will always run the same code, which makes your build stable.
It will also prevent a potential security issue where a tag could be replaced by a malicious commit without consumers being aware of it.

The PR updates each non-SHA based workflow reference with the SHA of the referenced version/tag, so the current behavior should not change.

See https://exercism.org/docs/building/github/gha-best-practices#h-pin-actions-to-shas for more information.

@ErikSchierboom ErikSchierboom requested a review from a team as a code owner November 14, 2023 13:41
@ErikSchierboom ErikSchierboom added the x:size/tiny Tiny amount of work label Nov 14, 2023
Copy link

github-actions bot commented Nov 14, 2023

Pull Request Test Coverage Report for Build 6864591962

  • 0 of 0 changed or added relevant lines in 0 files are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage remained the same at 65.835%

Totals Coverage Status
Change from base Build 6863048637: 0.0%
Covered Lines: 422
Relevant Lines: 641

💛 - Coveralls

@ErikSchierboom ErikSchierboom force-pushed the pin-github-action-workflows branch 2 times, most recently from 01236ab to 2d0f8bd Compare November 14, 2023 13:54
@ErikSchierboom ErikSchierboom merged commit 576be3d into main Nov 21, 2023
10 checks passed
@ErikSchierboom ErikSchierboom deleted the pin-github-action-workflows branch November 21, 2023 07:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
x:size/tiny Tiny amount of work
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant