chore: update code_health third parties action to their shas #3078
Conversation
|
If you see the code they use it as a library, https://github.com/golangci/golangci-lint/blob/8f348db7bbd6366c528a369ad0b02505afd265c8/pkg/golinters/staticcheck/staticcheck.go#L4C22-L4C33 the note is just because of beef between the two projects |
|
ah okay, I was tricked by |
andreaangiolillo
changed the title
| with: | ||
| config: ${{ vars.PERMISSIONS_CONFIG }} | ||
| - uses: actions/checkout@v4 | ||
| - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 |
There was a problem hiding this comment.
my understanding was that actions supported by GH could remain on numbers and not shas, has this changed?
There was a problem hiding this comment.
using shas is actually really bad for security scanning tools as you may be able to see from #3063
There was a problem hiding this comment.
I was unaware of this, could you share where it was decided?
There was a problem hiding this comment.
no problem if you don't find it. It makes sense that GH actions can be trusted
Proposed changes
Update the code health third parties action to their sha