Repository navigation
Conversation
|
Valid changes, but I will hold of with merging it, until all of the used actions have immutable releases |
I don't think GitHub themselves will care about it given that they are known for ignoring people's warnings all together, especially the checkout's |
Looked into v7.0.2 of upload-artifact and it's not immutable, so my theory is correct. |
|
Is there actually any reason to switch back to version tags for half of the actions, when dependabot is updating/maintaining them anyway? |
If it's immutable then we don't need to set the version tags to commit IDs. checkout and upload-artifact are the only projects that need that. If there is a bad version then roll back immediately. |
But we currently don't set version tags manually, because dependabot manages the updates, so I don't think going back to the old system has any advantages |
It technically does which is that keeping track of updates manually is much easier than having to copy commit IDs all the time. |
setup-gradle, setup-java and docker's actions are immutable meaning they no longer need to be pinned, unfortunately checkout and upload-artifact still suffer from possible supply chain attacks whereas crowdin needs a new release to be considered immutable.