Pin GHA versions #2679
Pin GHA versions #2679
Conversation
twiggy diff reportDifference in .wasm size before and after this pull request. |
|
I'm off for a few days, and I'll deal with this afterwards. If this PR gets merged beforehand I'll revert it when I'm back. |
|
No problem. I'll leave it hanging for now. |
| @@ -60,13 +60,13 @@ jobs: | |||
| const fs = require('fs'); | |||
| return fs.readFileSync('./number', 'utf8').toString(); | |||
| result-encoding: string | |||
| - uses: peter-evans/find-comment@v2 | |||
| - uses: peter-evans/find-comment@1769778a0c5bd330272d749d12c036d65e70d39d # v2.0.0 | |||
There was a problem hiding this comment.
just curious: why not pin to v2.0.0?
| - uses: peter-evans/find-comment@1769778a0c5bd330272d749d12c036d65e70d39d # v2.0.0 | |
| - uses: peter-evans/[email protected] |
There was a problem hiding this comment.
It's pretty simple. When you point to the tag, then in case if GHA repo will get compromised (which is out of our control), tag can be easily moved to another commit, branch etc. opening the gate for some malicious manipulations - like the one described here. And we will not even get notified about such events.
With the hash such things will not work.
Yes, it might be not so convenient, but it is an eternal trade off - security vs convenience.
Also dependabot can track GHA updates by the hash as well.
In order to improve our security posture with GitHub Actions usage. I've made a version pinning ether to commit hash or to specific version.
Related issues and policy:
https://github.com/paritytech/ci_cd/issues/464
https://github.com/paritytech/ci_cd/wiki/Policies-and-regulations:-GitHub-Actions-usage-policies