You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hey, I'm back (see #1224) with another security suggestion!
Docker image tags are mutable and can therefore be modified by malicious actors. A solution is to pin the image to a hash instead. This ensures the image will always do what you expect.
The images can be kept up-to-date with dependabot. Whenever a new version of an Action is released, you'll receive a PR updating its hash (see my fork's PR for an example).
I'll send a PR along with this issue to pin the images and set up dependabot to keep an eye on them.
The text was updated successfully, but these errors were encountered:
Hey, I'm back (see #1224) with another security suggestion!
Docker image tags are mutable and can therefore be modified by malicious actors. A solution is to pin the image to a hash instead. This ensures the image will always do what you expect.
The images can be kept up-to-date with dependabot. Whenever a new version of an Action is released, you'll receive a PR updating its hash (see my fork's PR for an example).
I'll send a PR along with this issue to pin the images and set up dependabot to keep an eye on them.
The text was updated successfully, but these errors were encountered: