ARUNAVO RAY a02865a1aa ci: pin third-party GitHub Actions to commit SHAs (#293) ...

Tags are mutable. A compromised maintainer (or a maintainer's compromised
machine) can force-move v-tags to point at malicious commits, and any workflow
using `@vN` picks up the malicious code on its next run — see the recent
`actions-cool/issues-helper` / `maintain-one-comment` incident exfiltrating
credentials from `Runner.Worker` memory.

This commit pins every third-party action in the two workflows that handle
secrets (GHCR push, Docker Hub login, Scout token) to immutable 40-char SHAs,
with a trailing comment naming the release version for readability. SHAs are
the latest released tag at time of pin.

The two DeterminateSystems actions were on `@main` — a *branch* ref that moves
on every push, materially worse than a tag — and are now pinned to the latest
release SHAs (v22 / v13).

First-party `actions/*` and `github/codeql-action` are left on tags for now;
they're a separate, lower-risk follow-up.

2026-05-19 12:44:23 +05:30

..

assets

Updated screenshots

2025-10-22 19:55:56 +05:30

ci

refactor: rename skipStarredIssues to starredCodeOnly

2025-10-03 09:22:18 +05:30

screenshots

feat: smart force-push protection with backup strategies (#206)

2026-03-02 15:48:59 +05:30

workflows

ci: pin third-party GitHub Actions to commit SHAs (#293)

2026-05-19 12:44:23 +05:30

FUNDING.yml

Create FUNDING.yml

2025-07-17 11:18:04 +05:30