Lock your GitHub Actions

GitHub Actions now supports workflow lockfiles. Because GitHub Actions are fetched from Git, the previous advice was to pin to a full SHA instead of a tag. This is because tags are mutable and susceptible to supply-chain attacks where an attacker points a previously safe tag at malicious code. For example, an old workflow looks like: name: Lint on: [push, pull_request, workflow_dispatch] permissions: {} env: FORCE_COLOR: 1 RUFF_OUTPUT_FORMAT: github jobs: lint: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: j178/prek-action@44924fe9ef4a6f88253c4b6b1bf11c689d3ce53d # v3.1.0 Here’s how I set up lockfiles. Install #Install the gh-actions-lock extension to the gh CLI: $ gh extension install github/gh-actions-lock ✓ Installed extension github/gh-actions-lock Lock ’em #In your repo, run: $ gh actions-lock ✓ All 1 workflows valid The workflow now uses vX.Y.Z tags and looks like this: diff --git…

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town