mirror of
https://github.com/kata-containers/kata-containers.git
synced 2025-04-27 19:35:32 +00:00
a678046d13
A popular third-party action has recently been compromised [1][2] and the attacker managed to point multiple git version tags to a malicious commit containing code to exfiltrate secrets. This PR follows GitHub's recommendation [3] to pin third-party actions to a full-length commit hash, to mitigate such attacks. Hopefully actionlint starts warning about this soon [4]. [1] https://www.cve.org/CVERecord?id=CVE-2025-30066 [2] https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised [3] https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions [4] https://github.com/rhysd/actionlint/pull/436 Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
31 lines
615 B
YAML
31 lines
615 B
YAML
#
|
|
# Copyright (c) 2022 Red Hat
|
|
#
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
#
|
|
|
|
name: 'Cargo Crates Check'
|
|
description: 'Checks every Cargo.toml file using cargo-deny'
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
|
|
runs:
|
|
using: "composite"
|
|
steps:
|
|
- name: Install Rust
|
|
uses: actions-rs/toolchain@v1
|
|
with:
|
|
profile: minimal
|
|
toolchain: nightly
|
|
override: true
|
|
|
|
- name: Cache
|
|
uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3 # v2.7.7
|
|
|
|
- name: Install Cargo deny
|
|
shell: bash
|
|
run: |
|
|
which cargo
|
|
cargo install --locked cargo-deny || true
|