| After tj-actions hack, I put together a little tool to go through all of github actions in repository to replace them with commit hash of the version https://github.com/santrancisco/pmw It has a few "features" which allowed me to go through a repository quickly: - It prompts user and recommend the hash, it also provides user the url to the current tag/action to double check the hash value matches and review the code if needed - Once you accept a change, it will keep that in a json file so future exact vesion of the action will be pinned as well and won't be reprompted. - It let you also ignore version tag for github actions coming from well-known, reputational organisation (like "actions" belong to github) - as you may want to keep updating them so you receive hotfix if something not backward compatible or security fixes. This way i have full control of what to pin and what not and then this config file is stored in .github folder so i can go back, rerun it again and repin everything. |