Conversation
There was a problem hiding this comment.
Pull request overview
This PR aims to improve supply-chain security by pinning GitHub Actions used in CI workflows to specific commit SHAs instead of floating version tags. This prevents malicious actors from compromising workflows by modifying tags on upstream repositories.
Changes:
- Pin
docker/setup-buildx-actionin on-tag.yml workflow to a specific commit SHA with version reference - Pin
vmactions/freebsd-vmin ci.yml workflow to a specific commit SHA with version reference
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| .github/workflows/on-tag.yml | Pins docker/setup-buildx-action to commit SHA 8d2750c68a42422c14e847fe6c8ac0403b4cbd6f (v3.12.0) |
| .github/workflows/ci.yml | Pins vmactions/freebsd-vm to commit SHA c9f815bc7aa0d34c9fdd0619b034a32d6ca7b57e (v1.4.2) |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
ale-exo
left a comment
ale-exo
left a comment
There was a problem hiding this comment.
utACK
https://github.com/docker/setup-buildx-action/releases/tag/v3.12.0https://github.com/vmactions/freebsd-vm/releases/tag/v1.4.2
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
ale-exo
left a comment
ale-exo
left a comment
There was a problem hiding this comment.
utACK
https://github.com/actions/cache/releases/tag/v3.4.0https://github.com/actions/checkout/releases/tag/v4.3.1https://github.com/actions/checkout/releases/tag/v3.6.0https://github.com/docker/setup-qemu-action/releases/tag/v3.7.0https://github.com/docker/setup-buildx-action/releases/tag/v3.12.0https://github.com/actions/github-script/releases/tag/v7.1.0
📝 Summary
Pin GitHub Actions used in CI workflows to full commit SHAs.
This removes floating action references and reduces supply-chain risk by ensuring workflow execution uses reviewed, immutable upstream revisions instead of tags that can be moved.