Improve gha #318
Improve gha #318
Conversation
Fix the github organization name to in-toto. Signed-off-by: Kairo de Araujo <kairo.araujo@testifysec.com>
It's a good practice to pin the GitHub Actions with full-length commit sha as described in the "Security hardening for GitHub Actions". https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions I noticed that dependabot also checks weekly with updates. It will maintain the updates using the hash. Signed-off-by: Kairo de Araujo <kairo.araujo@testifysec.com>
.github/workflows/release.yml
Outdated
| @@ -71,7 +71,7 @@ jobs: | |||
| run: go install github.com/goreleaser/goreleaser@latest | |||
|
|
|||
| - name: Run GoReleaser | |||
| uses: testifysec/witness-run-action@40aa4ef36fc431a37de7c3faebcb66513c03b934 | |||
| uses: in-toto/witness-run-action@40aa4ef36fc431a37de7c3faebcb66513c03b934 | |||
There was a problem hiding this comment.
I think the action has not been moved to @in-toto.
There was a problem hiding this comment.
There was a problem hiding this comment.
I pushed it without my last amend :|
kairoaraujo
force-pushed
the
improve-gha
branch
from
5d6dd8b
to
d8d416c
Compare
|
Should we also make it pinned? witness/.github/workflows/verify-licence.yml Lines 16 to 17 in d8d416c |
.github/workflows/witness.yml
Outdated
| @@ -56,7 +56,7 @@ jobs: | |||
| path: /tmp | |||
|
|
|||
| - if: ${{ inputs.pre-command != '' && inputs.pull_request == false }} | |||
| uses: testifysec/witness-run-action@40aa4ef36fc431a37de7c3faebcb66513c03b934 | |||
| uses: in-toto/witness-run-action@40aa4ef36fc431a37de7c3faebcb66513c03b934 | |||
There was a problem hiding this comment.
the name of the action remains an issue here, as it's not been moved to the in-toto org.
I think dependabot may not handle that? |
No, it will not handle it. |
Could we at least semver pin it? |
|
I see that my work here duplicates #316. |
Fix the github organization name to in-toto.
pin GHA full-length commit SHA
It's a good practice to pin the GitHub Actions with full-length
commit sha as described in the "Security hardening for GitHub
Actions".
https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
I noticed that dependabot also checks weekly with updates.
It will maintain the updates using the hash.