Comment on Trivy under attack again: Widespread GitHub Actions tag compromise secretsparentComments−joeig5moThis recommendation is currently broken. Even when you pin the full commit SHA for an action, that action may still pull in transitive dependencies (other actions) that aren't pinned.−danudey5moTL;DR Github Actions is the NPM of CI systems.
Comments
This recommendation is currently broken. Even when you pin the full commit SHA for an action, that action may still pull in transitive dependencies (other actions) that aren't pinned.
TL;DR Github Actions is the NPM of CI systems.