Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: renovate bot setting to pin actions to a full length commit SHA

Merged
merged 1 commit into from Jun 13, 2022

Conversation

naveensrinivasan
Copy link
Contributor

@naveensrinivasan naveensrinivasan commented Jun 13, 2022

Pin actions to a full length commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release.
Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository,
as they would need to generate a SHA-1 collision for a valid Git object payload.

Summary

Test plan

Does this PR introduce a breaking change?

  • Yes
  • No

Other information

- https://docs.renovatebot.com/modules/manager/github-actions/#additional-information

- Pinned actions by SHA https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies

>Pin actions to a full length commit SHA

>Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release.
> Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository,
> as they would need to generate a SHA-1 collision for a valid Git object payload.

- https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
- https://github.com/renovatebot/.github/blob/b0c3aa85ef2bb242580f20b02b380ca532b4ce17/default.json#L13
@coveralls
Copy link

coveralls commented Jun 13, 2022

Pull Request Test Coverage Report for Build 2485421816

  • 0 of 0 changed or added relevant lines in 0 files are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage remained the same at 94.004%

Totals Coverage Status
Change from base Build 2480589202: 0.0%
Covered Lines: 1117
Relevant Lines: 1154

💛 - Coveralls

ahnpnl
ahnpnl approved these changes Jun 13, 2022
Copy link
Collaborator

@ahnpnl ahnpnl left a comment

Thanks!

@ahnpnl ahnpnl merged commit 4be1e0d into kulshekhar:main Jun 13, 2022
16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants