[wallrat]

Been tracking this project for a while https://github.com/chains-project/ghasum . It creates a verifiable checksum manifest for all actions - still in development but looks very promising.

Will be a good compliment to Github's Immutable Actions when they arrive.

[esafak]

Here is an example in the wild: https://github.com/actions/checkout/actions/workflows/publis...

[esafak]

https://github.com/features/preview/immutable-actions