Aurélien Bombo a678046d13 gha: Pin third-party actions to commit hashes ... A popular third-party action has recently been compromised [1][2] and the attacker managed to point multiple git version tags to a malicious commit containing code to exfiltrate secrets. This PR follows GitHub's recommendation [3] to pin third-party actions to a full-length commit hash, to mitigate such attacks. Hopefully actionlint starts warning about this soon [4]. [1] https://www.cve.org/CVERecord?id=CVE-2025-30066 [2] https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised [3] https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions [4] https://github.com/rhysd/actionlint/pull/436 Signed-off-by: Aurélien Bombo <abombo@microsoft.com>		2025-03-19 13:52:49 -05:00
..
cargo-deny-generator.sh	CI: Eliminating dependency on clone_tests_repo()	2024-06-28 14:52:02 +02:00
cargo-deny-skeleton.yaml.in	gha: Pin third-party actions to commit hashes	2025-03-19 13:52:49 -05:00