Use our own GitHub Action in our demos #40
Conversation
| @@ -25,11 +25,9 @@ jobs: | |||
| persist-credentials: false | |||
|
|
|||
| - name: Mount EESSI CernVM-FS software repository | |||
| uses: cvmfs-contrib/github-action-cvmfs@55899ca74cf78ab874bdf47f5a804e47c198743c # v4.0 | |||
| uses: eessi/github-action-eessi@v3 | |||
There was a problem hiding this comment.
I'd suggest to use the latest version (v3.1) of our github action. See EESSI/github-action-eessi@v3.0.0...v3.1.0
There was a problem hiding this comment.
Leaving it loose implies using the latest v3 release (so v3.1.0 today and v3.2.0 when it comes out)
There was a problem hiding this comment.
This is actually the reason that referencing GitHub Actions by tag is insecure, since you can change the commit the tag points to at any point.
There was a problem hiding this comment.
Didn't know that. Thanks for clarifying it. Would we want to use then a specific commit instead of v3?
There was a problem hiding this comment.
It's our own action and one of the few places we use it, it's a good thing to actually see whether it breaks on new releases
No description provided.