-
Notifications
You must be signed in to change notification settings - Fork 10.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
pin gha #60948
pin gha #60948
Conversation
Co-authored-by: Jeff Handley <jeffhandley@users.noreply.github.com>
Co-authored-by: Jeff Handley <jeffhandley@users.noreply.github.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We'll likely have to update the hard-coded list of approved 3rd-party action SHAs in repo settings - let me know if you want me to take care of that after this is merged
First I've heard of this list - good to hear it. Where is it? Feel free to hit merge and update or I can. |
https://github.com/dotnet/aspnetcore/settings/actions - updating now |
/backport to release/9.0 |
Started backporting to release/9.0: https://github.com/dotnet/aspnetcore/actions/runs/13953100523 |
@wtgodbe backporting to "release/9.0" failed, the patch most likely resulted in conflicts: $ git am --3way --empty=keep --ignore-whitespace --keep-non-patch changes.patch
Applying: pin gha
Using index info to reconstruct a base tree...
M .github/workflows/update-sdk.yml
A .github/workflows/update-selenium-and-playwright-dependencies.yml
Falling back to patching base and 3-way merge...
CONFLICT (modify/delete): .github/workflows/update-selenium-and-playwright-dependencies.yml deleted in HEAD and modified in pin gha. Version pin gha of .github/workflows/update-selenium-and-playwright-dependencies.yml left in tree.
Auto-merging .github/workflows/update-sdk.yml
CONFLICT (content): Merge conflict in .github/workflows/update-sdk.yml
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 pin gha
Error: The process '/usr/bin/git' failed with exit code 128 Please backport manually! |
(That was a test, we don't actually want this change in 9.0) |
given https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised
pin our github actions using https://github.com/mheap/pin-github-action and spot check the SHAs.