Gh-actions-lockfile: generate and verify lockfiles for GitHub Actions
gh-actions-lockfile.net
Gh-actions-lockfile: generate and verify lockfiles for GitHub Actions
1–10 of 28 posts
Re: Gh-actions-lockfile: generate and verify lockfiles for GitHub Actions
#2Mildly ironic that the quickstart suggests starting with an unpinned action
gjtorikian/gh-actions-lockfile@v1
Presumably since it has to run first it must run unpinned?
Re: Gh-actions-lockfile: generate and verify lockfiles for GitHub Actions
#3https://github.com/suzuki-shunsuke/pinact works great
Re: Gh-actions-lockfile: generate and verify lockfiles for GitHub Actions
#4Mildly ironic that the quickstart suggests starting with an unpinned action gjtorikian/gh-actions-lockfile@v1 Presumably since it has to run first it must run unpinned?
Arguably, that's exactly the one action that will need to be hash-pinned, since all the consecutive actions will at least be verified against the lockfile.
Re: Gh-actions-lockfile: generate and verify lockfiles for GitHub Actions
#5I have been banging on that drum for like 2 years now, glad the community has figured a way around it. Still utterly ridiculous that this is not native.
They even closed the immutable action issue as a "wont fix" cause you know when it's too hard we all know the best way is to give up. Not like there wasany major security incident this year due to this /s
Re: Gh-actions-lockfile: generate and verify lockfiles for GitHub Actions
#6Pinning actions doesn't really work because most action dependencies are unpinned thanks to npm default behaviour of not pinning them.
Re: Gh-actions-lockfile: generate and verify lockfiles for GitHub Actions
#7I have been banging on that drum for like 2 years now, glad the community has figured a way around it. Still utterly ridiculous that this is not native. They even closed the immutable action issue as a "wont fix" cause you know when it's too hard we all know the best way is to give up. Not like there wasany major security incident this year due to this /s
I feel like at this point we should just abandon GitHub Actions altogether.
Re: Gh-actions-lockfile: generate and verify lockfiles for GitHub Actions
#8From what I see, this does not help with pinning the dependencies and it doesn’t verify the downloaded action has the same content as it used to have. In other words, this is a tiny patch on a big wound.
We use commit hashes to pin actions, have the version as a comment (e.g # v4) and renovate will keep both up to date in the PRs.
And there is a more or less recently added repository setting to require actions to be pinned to hashes.
Re: Gh-actions-lockfile: generate and verify lockfiles for GitHub Actions
#9Why do you need this?
Just pin your actions to shasum
Re: Gh-actions-lockfile: generate and verify lockfiles for GitHub Actions
#10Why do you need this? Just pin your actions to shasum
If that action itself has unpinned dependencies that doesn't accomplish much.