News for hackers. Stuff that matters.

A comment on How to Harden GitHub Actions: The Unofficial Guide. Parent comment

Re:How to Harden GitHub Actions: The Unofficial Guide by newman314 on Thursday May 08, 2025 @01:35PM (#43928837)
I don't know if your tool already does this but it would be helpful if there is an option to output the version as a comment of the form

action@commit # semantic version

Makes it easy to quickly determine what version the hash corresponds to. Thanks.

[ Parent | on HN ]
Re:How to Harden GitHub Actions: The Unofficial Guide by ebfe1 on Thursday May 08, 2025 @10:45PM (#43933364)
Yeap - that is exactly what it does ;)

Example:

uses: ncipollo/release-action@440c8c1cb0ed28b9f43e4d1d670870f059653174 #v1.16.0

And for anything that previously had @master, it becomes the following with the hash on the day it was pinned with "master-{date}" as comment:

uses: ravsamhq/notify-slack-action@b69ef6dd56ba780991d8d48b61d94682c5b92d45 #master-2025-04-04

[ Parent | on HN ]