Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: change gha version to SHA #813

Merged
merged 1 commit into from
Sep 6, 2021
Merged

fix: change gha version to SHA #813

merged 1 commit into from
Sep 6, 2021

Conversation

Jakub-Kwak
Copy link
Contributor

@Jakub-Kwak Jakub-Kwak commented Sep 1, 2021

CI-601
Using master as as version of 3rd party GitHub action is a potential security risk.
We are changing from:
uses: elastic/elastic-github-actions/elasticsearch@master
to:
uses: elastic/elastic-github-actions/elasticsearch@<SHA-key>
What I did is just went to the repository, and got the latest SHA of the master.
3rd party GHA repositories changed within this PR:

How to test

  • Green check on this PR is enough

Before submitting the PR make sure the following are checked:

  • The PR relates to only one subject with a clear title and description in grammatically correct, complete sentences.
  • Wrote good commit messages.
  • Commit message starts with [Fix #issue-number] (if the related issue exists).
  • Feature branch is up-to-date with master (if not - rebase it).
  • Squashed related commits together.
  • Added tests.
  • [ ] Added an entry to the changelog if the new code introduces user-observable changes. See changelog entry format for details.

@Jakub-Kwak Jakub-Kwak changed the title Change gha version to SHA fix: change gha version to SHA Sep 3, 2021
@videnovnebojsa videnovnebojsa merged commit c9d1159 into master Sep 6, 2021
@videnovnebojsa videnovnebojsa deleted the change-to-sha branch September 6, 2021 09:44
cyucelen pushed a commit to cyucelen/chewy that referenced this pull request Jan 28, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants