Skip to content

ci: pin external GitHub Action#2363

Merged
goaway merged 1 commit intomainfrom
ms/pin-external-action
Jun 10, 2022
Merged

ci: pin external GitHub Action#2363
goaway merged 1 commit intomainfrom
ms/pin-external-action

Conversation

@goaway
Copy link
Copy Markdown
Contributor

@goaway goaway commented Jun 10, 2022

Description: Improves security with respect to third-party actions. See:
https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions

I also read through the recent commits and updated to the latest release, since it contained a few bugfixes.

Risk: Low
Testing: CI

Signed-off-by: Mike Schore mike.schore@gmail.com

Signed-off-by: Mike Schore <mike.schore@gmail.com>
@goaway goaway requested a review from Augustyniak June 10, 2022 19:06
Copy link
Copy Markdown
Contributor

@Augustyniak Augustyniak left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In general the SHA seems to be a valid peter-evans/create-pull-request SHA. One thing that I want to point out in public - and that was briefly discussed by us offline - is that this PR moves us from v3 to v4.0.4.

@goaway goaway merged commit e901510 into main Jun 10, 2022
@goaway goaway deleted the ms/pin-external-action branch June 10, 2022 19:50
jpsim added a commit that referenced this pull request Jun 14, 2022
* origin/main: (33 commits)
  iOS: fix xcframework upload in release workflow (#2366)
  config: hopefully fixing C++ config default for apple (#2355)
  Update Envoy (#2364)
  Bump Lyft Support Rotation (#2365)
  ci: pin external GitHub Action (#2363)
  cleanup: fix warning in JNI layer (#2361)
  cleanup: convert some more uses of NULL to nullptr (#2359)
  cleanup: consistently use nullptr in cc contexts (#2351)
  cleanup: remove unused function and resolve warning (#2350)
  iOS: add configurable gzip and brotli decompression options (#2349)
  iOS: stop embedding bitcode in releases (#2347)
  ci: update Android setup (#2354)
  docs: update the list of clusters (#2344)
  bazel: update rules_apple (#2346)
  iOS: add a way to disable network monitoring (#2345)
  api: adding brotli knobs (#2342)
  android: create persistent SharedPreferences-based KV store (#2319)
  ios: add support for registering a platform KV store (#2334)
  builder: making compressor configurable (#2321)
  iOS: add SwiftPM example (#2333)
  ...

Signed-off-by: JP Simard <jp@jpsim.com>
jpsim added a commit that referenced this pull request Jun 14, 2022
* origin/main: (33 commits)
  iOS: fix xcframework upload in release workflow (#2366)
  config: hopefully fixing C++ config default for apple (#2355)
  Update Envoy (#2364)
  Bump Lyft Support Rotation (#2365)
  ci: pin external GitHub Action (#2363)
  cleanup: fix warning in JNI layer (#2361)
  cleanup: convert some more uses of NULL to nullptr (#2359)
  cleanup: consistently use nullptr in cc contexts (#2351)
  cleanup: remove unused function and resolve warning (#2350)
  iOS: add configurable gzip and brotli decompression options (#2349)
  iOS: stop embedding bitcode in releases (#2347)
  ci: update Android setup (#2354)
  docs: update the list of clusters (#2344)
  bazel: update rules_apple (#2346)
  iOS: add a way to disable network monitoring (#2345)
  api: adding brotli knobs (#2342)
  android: create persistent SharedPreferences-based KV store (#2319)
  ios: add support for registering a platform KV store (#2334)
  builder: making compressor configurable (#2321)
  iOS: add SwiftPM example (#2333)
  ...

Signed-off-by: JP Simard <jp@jpsim.com>
Augustyniak pushed a commit that referenced this pull request Jun 28, 2022
Description: Improves security with respect to third-party actions. See:
https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions

I also read through the recent commits and updated to the latest release, since it contained a few bugfixes.

Risk: Low
Testing: CI

Signed-off-by: Mike Schore <mike.schore@gmail.com>
Signed-off-by: Rafal Augustyniak <raugustyniak@lyft.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants