Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Pin commit hash of github actions to avoid supply chain attacks #1576

Merged
merged 4 commits into from
Mar 26, 2025
Merged

Pin commit hash of github actions to avoid supply chain attacks #1576

merged 4 commits into from
Mar 26, 2025

Conversation

Yang-33
Copy link
Contributor

@Yang-33 Yang-33 commented Mar 26, 2025 •
edited
Loading

Changes

To avoid supply chain attacks, specify actions in GitHub Actions workflows using commit hashes instead of version numbers. Pinact-action will fail the CI job if this is not done. Renovate already supports updates in the commit hash state, so there is no issue.

References

Other repositories

This was referenced Mar 26, 2025
Merged
Merged
Merged
Merged
Merged
Merged
Yang-33 added a commit to line/line-bot-sdk-nodejs that referenced this pull request Mar 26, 2025
@Yang-33
Pin commit hash of github actions to avoid supply chain attacks (#1201)
409ace4 
## Changes
To avoid supply chain attacks, specify actions in GitHub Actions
workflows using commit hashes instead of version numbers. Pinact-action
will fail the CI job if this is not done. Renovate already supports
updates in the commit hash state, so there is no issue.

## References
- https://github.com/suzuki-shunsuke/pinact-action
- does pinact-action verify the checksum of the version of aqua it is
using? Yes!:
- https://github.com/suzuki-shunsuke/pinact

## Other repositories
- line/line-bot-sdk-python
line/line-bot-sdk-python#772
- line/line-bot-sdk-php
line/line-bot-sdk-php#680
- line/line-bot-sdk-nodejs
#1201
- line/line-bot-sdk-java
line/line-bot-sdk-java#1576
- line/line-bot-sdk-go line/line-bot-sdk-go#555
- line/line-bot-sdk-ruby
line/line-bot-sdk-ruby#405
- line/line-openapi line/line-openapi#90
Yang-33 added a commit to line/line-bot-sdk-python that referenced this pull request Mar 26, 2025
@Yang-33
Pin commit hash of github actions to avoid supply chain attacks (#772)
cad0b19 
## Changes
To avoid supply chain attacks, specify actions in GitHub Actions
workflows using commit hashes instead of version numbers. Pinact-action
will fail the CI job if this is not done. Renovate already supports
updates in the commit hash state, so there is no issue.

## References
- https://github.com/suzuki-shunsuke/pinact-action
- does pinact-action verify the checksum of the version of aqua it is
using? Yes!:
- https://github.com/suzuki-shunsuke/pinact

## Other repositories
- line/line-bot-sdk-python
#772
- line/line-bot-sdk-php
line/line-bot-sdk-php#680
- line/line-bot-sdk-nodejs
line/line-bot-sdk-nodejs#1201
- line/line-bot-sdk-java
line/line-bot-sdk-java#1576
- line/line-bot-sdk-go line/line-bot-sdk-go#555
- line/line-bot-sdk-ruby
line/line-bot-sdk-ruby#405
- line/line-openapi line/line-openapi#90
@Yang-33 Yang-33 merged commit cd83271 into line:master Mar 26, 2025
6 checks passed
Yang-33 added a commit to line/line-bot-sdk-go that referenced this pull request Mar 26, 2025
@Yang-33
Pin commit hash of github actions to avoid supply chain attacks (#555)
eb60d35 
## Changes
To avoid supply chain attacks, specify actions in GitHub Actions
workflows using commit hashes instead of version numbers. Pinact-action
will fail the CI job if this is not done. Renovate already supports
updates in the commit hash state, so there is no issue.

## References
- https://github.com/suzuki-shunsuke/pinact-action
- does pinact-action verify the checksum of the version of aqua it is
using? Yes!:
- https://github.com/suzuki-shunsuke/pinact

## Other repositories
- line/line-bot-sdk-python
line/line-bot-sdk-python#772
- line/line-bot-sdk-php
line/line-bot-sdk-php#680
- line/line-bot-sdk-nodejs
line/line-bot-sdk-nodejs#1201
- line/line-bot-sdk-java
line/line-bot-sdk-java#1576
- line/line-bot-sdk-go #555
- line/line-bot-sdk-ruby
line/line-bot-sdk-ruby#405
- line/line-openapi line/line-openapi#90
Yang-33 added a commit to line/line-bot-sdk-ruby that referenced this pull request Mar 26, 2025
@Yang-33
Pin commit hash of github actions to avoid supply chain attacks (#405)
daad632 
## Changes
To avoid supply chain attacks, specify actions in GitHub Actions
workflows using commit hashes instead of version numbers. Pinact-action
will fail the CI job if this is not done. Renovate already supports
updates in the commit hash state, so there is no issue.

## References
- https://github.com/suzuki-shunsuke/pinact-action
- does pinact-action verify the checksum of the version of aqua it is
using? Yes!:
- https://github.com/suzuki-shunsuke/pinact

## Other repositories
- line/line-bot-sdk-python
line/line-bot-sdk-python#772
- line/line-bot-sdk-php
line/line-bot-sdk-php#680
- line/line-bot-sdk-nodejs
line/line-bot-sdk-nodejs#1201
- line/line-bot-sdk-java
line/line-bot-sdk-java#1576
- line/line-bot-sdk-go line/line-bot-sdk-go#555
- line/line-bot-sdk-ruby
#405
- line/line-openapi line/line-openapi#90
Yang-33 added a commit to line/line-openapi that referenced this pull request Mar 26, 2025
@Yang-33
Pin commit hash of github actions to avoid supply chain attacks (#90)
cc542e3 
## Changes
To avoid supply chain attacks, specify actions in GitHub Actions
workflows using commit hashes instead of version numbers. Pinact-action
will fail the CI job if this is not done. Renovate already supports
updates in the commit hash state, so there is no issue.

(At this point, since this repository provides YAML, it might be
considered unnecessary, but having it prepared doesn't hurt.)


## References
- https://github.com/suzuki-shunsuke/pinact-action
- does pinact-action verify the checksum of the version of aqua it is
using? Yes!:
- https://github.com/suzuki-shunsuke/pinact

## Other repositories
- line/line-bot-sdk-python
line/line-bot-sdk-python#772
- line/line-bot-sdk-php
line/line-bot-sdk-php#680
- line/line-bot-sdk-nodejs
line/line-bot-sdk-nodejs#1201
- line/line-bot-sdk-java
line/line-bot-sdk-java#1576
- line/line-bot-sdk-go line/line-bot-sdk-go#555
- line/line-bot-sdk-ruby
line/line-bot-sdk-ruby#405
- line/line-openapi #90
@Yang-33 Yang-33 self-assigned this Mar 26, 2025
@Yang-33 Yang-33 deleted the pinact branch March 26, 2025 13:09
Yang-33 added a commit to line/line-bot-sdk-php that referenced this pull request Mar 27, 2025
@Yang-33
Pin commit hash of github actions to avoid supply chain attacks (#680)
72a263b 
## Changes
To avoid supply chain attacks, specify actions in GitHub Actions
workflows using commit hashes instead of version numbers. Pinact-action
will fail the CI job if this is not done. Renovate already supports
updates in the commit hash state, so there is no issue.

## References
- https://github.com/suzuki-shunsuke/pinact-action
- does pinact-action verify the checksum of the version of aqua it is
using? Yes!:
- https://github.com/suzuki-shunsuke/pinact

## Other repositories
- line/line-bot-sdk-python
line/line-bot-sdk-python#772
- line/line-bot-sdk-php
#680
- line/line-bot-sdk-nodejs
line/line-bot-sdk-nodejs#1201
- line/line-bot-sdk-java
line/line-bot-sdk-java#1576
- line/line-bot-sdk-go line/line-bot-sdk-go#555
- line/line-bot-sdk-ruby
line/line-bot-sdk-ruby#405
- line/line-openapi line/line-openapi#90
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@eucyt eucyt eucyt approved these changes

Assignees

@Yang-33 Yang-33

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@Yang-33 @eucyt