Skip to content

v0.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Apr 23:31
· 2 commits to main since this release
v0.2.0
e328c89
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Features

  • --verify-shas: verify SHA-pinned action refs are reachable from their upstream repo (#4)
  • --fail-on-warnings: exit non-zero when any warnings fire (#4)
  • --resolve-refs: optionally resolve tag and branch refs to commit SHAs at scan time (#7)
  • OSV 1.7.5 advisory format: advisories are now consumed in OSV format from abom-advisories (#6)

Fixes

  • SHA-pinned refs at fixed versions are no longer flagged as compromised (#8). Tag resolution via git ls-remote enables version comparison for SHA-pinned actions. Runs automatically with --check, no extra flag needed.

Thanks

Contributors

digorgonzola
Assets 9
Loading