chore: update code_health third parties action to their shas#3078
chore: update code_health third parties action to their shas#3078andreaangiolillo wants to merge 21 commits intomasterfrom
Conversation
gssbzn
left a comment
gssbzn
left a comment
There was a problem hiding this comment.
not the same binary but the same rules, does the binary matter?
|
If you see the code they use it as a library, https://github.com/golangci/golangci-lint/blob/8f348db7bbd6366c528a369ad0b02505afd265c8/pkg/golinters/staticcheck/staticcheck.go#L4C22-L4C33 the note is just because of beef between the two projects |
|
ah okay, I was tricked by |
andreaangiolillo
changed the title
| with: | ||
| config: ${{ vars.PERMISSIONS_CONFIG }} | ||
| - uses: actions/checkout@v4 | ||
| - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 |
There was a problem hiding this comment.
my understanding was that actions supported by GH could remain on numbers and not shas, has this changed?
There was a problem hiding this comment.
using shas is actually really bad for security scanning tools as you may be able to see from #3063
There was a problem hiding this comment.
I was unaware of this, could you share where it was decided?
There was a problem hiding this comment.
no problem if you don't find it. It makes sense that GH actions can be trusted
2 participants
Proposed changes
Update the code health third parties action to their sha