Conversation
|
Honestly, I don't know how to think about this one. This is not a bad idea but the keeping it up to date is kind of a hell. Normally, we only need to secure the release pipeline. Using hash is almost the same as using the exact semver (v0.1.2 for example). It's also useful to use hash when a fix is here but yet release. We should dive deeper for the pros and cons of this changes, I don't think it's a bad idea but we need more insight from other point of view for this one. |
d7387b4 to
d7b5bd2
Compare
Targetting stable counter the security argument. Stable is not a fixed version tag but keeps updating. This is what you want to avoid for supply chain attacks.
The allow-non-breakable-words rule now covers long URLs, making this manual exception unnecessary.
|
@AntwortEinesLebens thanks for the review. I addressed both of your points in recent commits:
Could you take another look when you get a chance? |
AntwortEinesLebens
left a comment
There was a problem hiding this comment.
One last change and this is ready to go
|
✅ Fixed: removed |
Summary
Update GitHub Actions to latest versions across all CI/CD workflows.
Changes