-
Notifications
You must be signed in to change notification settings - Fork 14
Security/issue 613 #614
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Security/issue 613 #614
Conversation
2ac43cf to
09d8b2d
Compare
|
Force push for removing an old commit from another PR |
|
currently blocking error in the CI: |
|
the |
|
this seems caused by |
|
seems same problem as rust-lang/rustfmt#6739 |
|
@onihilist for now, could you update the other |
@kanarus Yup I'm doing that right now ! |
|
Ok in commit 46463a3, I can't change EDIT: Same for |
Technically, pinning to a commit hash does not affect functionality, even for Trusted Publishing. It ensures the exact same code is executed but significantly improves security against supply chain attacks by making the dependency immutable. edit:
In other words, the way to specify the action's version (tag vs commit hash) does not affect the internal OIDC authentication logic (Trusted Publishing) or the auto-approving logic (GitHub API). |
No description provided.