root/xz
1
0
Fork 0
mirror of https://git.tukaani.org/xz.git synced 2026-10-31 03:14:56 +00:00
Code Issues Releases Wiki Activity

CI: Don't pin vmactions or MSYS2 actions to commit ID

Browse Source 
These workflows don't use any secrets other than GITHUB_TOKEN, which
only has the 'contents: read' permission. That is, if an action was
compromised, it shouldn't be able to modify the repository or steal any
secrets. I recognize that a compromised action isn't completely harmless
still. For example, the runners on GitHub have Internet access which the
action could abuse until the workflow timeout (currently 10 or 20 minutes)
expires.

Now we always use the most recent actions instead of ones that are
sometimes several months old. The hassle of updating the pinned
commit IDs goes away. The benefits feel bigger than the risks.

Link: https://github.com/tukaani-project/xz/pull/227
This commit is contained in:
Lasse Collin 2026-06-19 22:07:15 +03:00
parent 3c0dbed890
commit 0def412006
No known key found for this signature in database
GPG Key ID: 38EE757D69184620
7 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.github/workflows/dragonflybsd.yml vendored
View File

@ -20,7 +20,7 @@ jobs:
- name: Test in DragonFly BSD - name: Test in DragonFly BSD
id: test id: test
uses: vmactions/dragonflybsd-vm@323497fa680c1856dd1ba5c4fd89182a9194f649 #v1.2.7 uses: vmactions/dragonflybsd-vm@v1
with: with:
usesh: true usesh: true
prepare: > prepare: >

2
.github/workflows/freebsd.yml vendored
View File

@ -36,7 +36,7 @@ jobs:
- uses: actions/checkout@v7 - uses: actions/checkout@v7
- name: Test in FreeBSD - name: Test in FreeBSD
uses: vmactions/freebsd-vm@4807432c7cab1c3f97688665332c0b932062d31f #v1.4.3 uses: vmactions/freebsd-vm@v1
with: with:
release: ${{ matrix.release }} release: ${{ matrix.release }}
arch: ${{ matrix.arch }} arch: ${{ matrix.arch }}

2
.github/workflows/haiku.yml vendored
View File

@ -20,7 +20,7 @@ jobs:
- name: Test in Haiku - name: Test in Haiku
id: test id: test
uses: vmactions/haiku-vm@dd2b1b3b180e8e1eac82f5c209485d376e4f48c0 #v1.0.7 uses: vmactions/haiku-vm@v1
with: with:
usesh: true usesh: true
prepare: > prepare: >

4
.github/workflows/msys2.yml vendored
View File

@ -40,7 +40,7 @@ jobs:
steps: steps:
- name: Setup MSYS2 - name: Setup MSYS2
if: ${{ matrix.sys == 'msys' }} if: ${{ matrix.sys == 'msys' }}
uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2.30.0 uses: msys2/setup-msys2@v2
with: with:
msystem: ${{ matrix.sys }} msystem: ${{ matrix.sys }}
update: true update: true
@ -55,7 +55,7 @@ jobs:
- name: Setup MSYS2 - name: Setup MSYS2
if: ${{ matrix.sys != 'msys' }} if: ${{ matrix.sys != 'msys' }}
uses: msys2/setup-msys2@fb197b72ce45fb24f17bf3f807a388985654d1f2 # v2.29.0 uses: msys2/setup-msys2@v2
with: with:
msystem: ${{ matrix.sys }} msystem: ${{ matrix.sys }}
update: true update: true

2
.github/workflows/netbsd.yml vendored
View File

@ -20,7 +20,7 @@ jobs:
- name: Test in NetBSD - name: Test in NetBSD
id: test id: test
uses: vmactions/netbsd-vm@ca7ff0556959998c82761c34ea0c3c99fa084c48 #v1.3.7 uses: vmactions/netbsd-vm@v1
with: with:
usesh: true usesh: true
prepare: > prepare: >

2
.github/workflows/openbsd.yml vendored
View File

@ -19,7 +19,7 @@ jobs:
- uses: actions/checkout@v7 - uses: actions/checkout@v7
- name: Test in OpenBSD - name: Test in OpenBSD
uses: vmactions/openbsd-vm@3fafb45f2e2e696249c583835939323fe1c3448c #v1.3.7 uses: vmactions/openbsd-vm@v1
with: with:
usesh: true usesh: true
prepare: > prepare: >

2
.github/workflows/solaris.yml vendored
View File

@ -19,7 +19,7 @@ jobs:
- uses: actions/checkout@v7 - uses: actions/checkout@v7
- name: Test in Solaris - name: Test in Solaris
uses: vmactions/solaris-vm@0a231b94365d1911cf62097ef342f6b30d95598f #v1.3.2 uses: vmactions/solaris-vm@v1
with: with:
release: 11.4-gcc release: 11.4-gcc
usesh: true usesh: true