GitHub Actually Fixed SHA Pinning. I Wasn't Expecting That.

Back in March, I wrote The Comforting Lie of SHA Pinning, after spending rather too much of my Monday investigating the supply-chain compromise with Trivy and discovering something worrying about how GitHub Actions resolves dependencies.

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town