-
Notifications
You must be signed in to change notification settings - Fork 9
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Notify projects about the move #50
Comments
I would only pin the version if the package has dependabot setup for GitHub Actions workflows. |
But in the meantime we are talking about supply chain security, so using a master branch for anything anywhere doesn't feel like a best practice. |
Maybe I'm misunderstanding what your concerns are, but if something malicious were pushed to the master branch of this repo, that would also affect anyone using a pin with dependabot, once they merge the dependabot PR. |
Not if hashes are used. This has been part of recent discussions, e.g. here and references therein: scientific-python/summit-2024#9 (comment) |
Ahh, also, I wonder if you noticed that the repo has been moved. Therefore using |
Yes, I understand that. My comment was based on your "2)". And it looks like it was moved properly (with a redirect), so unless @larsoner actually does make a fork, the old references should continue to work. |
I guess in the sense that dependabot would stop working entirely? I would recommend against that, especially for this repo, which has historically required many fixes to fix breakages caused by GitHub and CircleCI changing various things. For me, pinning against master, or using a version pin with dependabot is all about being able to get bugfixes (which could include security fixes) from this workflow. The main difference with dependabot is you can verify things still work before upgrading, whereas with a As far as reproducible builds are concerned, is this workflow being used for packaging? My understanding is that it is primarily used to serve development documentation, since GitHub Actions does not allow hotlinking to files in artifacts but CircleCI does. |
Dependabot can work with hashes just fine. |
FWIW I forked but with |
There are 200+ packages using
uses: larsoner/circleci-artifacts-redirector-action@master
.We may want to consider opening PRs for them to update it to 1) the new location 2) using a numerical version, or even the hash for the latest release.
https://github.com/search?q=larsoner%2Fcircleci-artifacts-redirector-action%40master+NOT+is%3Afork+path%3A.github&type=code
The text was updated successfully, but these errors were encountered: