Re: [PATCH v2] ci: pin actions in the main workflow to full commit IDs

[Junio C Hamano <gitster@pobox.com>]

Taylor Blau <ttaylorr@openai.com> writes:

> Our main CI workflow refers to actions by version tags. These tags can
> move, changing the action code we run without any change to our
> repository. If an attacker gains access to an action's repository,
> they can move an existing tag to a malicious revision and have our
> workflow pick it up automatically.
>
> Pin these actions to full commit IDs so that moving a tag cannot
> substitute a different action revision. Updating the actions will
> require an explicit change to our workflow, including when picking up
> bug fixes and security fixes within a major version.
>
> Retain the version names in comments to keep the references readable
> and make future updates easier to review.
>
> Signed-off-by: Taylor Blau <ttaylorr@openai.com>
> ---
>  .github/workflows/main.yml | 64 +++++++++++++++++++-------------------
>  1 file changed, 32 insertions(+), 32 deletions(-)

With these changes, the proposal no longer appears to bend the
public version to suit a single employee's environment.  We might
even want to strengthen the reasoning by adding "becoming the
de facto security standard", borrowing from Ben Knoble's comment in
the previous round.

Thanks.  Queued.