root
/
xz
mirror of https://git.tukaani.org/xz.git
1
0
Fork 0
Code Issues Releases Wiki Activity

CI: Bump and ref actions by commit SHA in windows-ci.yml 

Referencing actions by commit SHA in GitHub workflows guarantees you are using an immutable version. Actions referenced by tags and branches are more vulnerable to attacks, such as the tag being moved to a malicious commit or a malicious commit being pushed to the branch.

It's important to make sure the SHA's are from the original repositories and not forks.

For reference:

https://github.com/msys2/setup-msys2/releases/tag/v2.20.1
27b3aa77f6

https://github.com/actions/checkout/releases/tag/v4.1.0
8ade135a41

https://github.com/actions/upload-artifact/releases/tag/v3.1.3
a8a3f3ad30

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
This commit is contained in:
Gabriela Gutierrez 2023-09-26 15:55:13 +00:00 committed by Jia Tan
parent f28cc9bd48
commit 37947d4a75
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
.github/workflows/windows-ci.yml vendored
View File

@ -40,7 +40,7 @@ jobs:
# Rely on the msys2 GitHub Action to set up the msys2 environment. # Rely on the msys2 GitHub Action to set up the msys2 environment.
- name: Setup MSYS2 - name: Setup MSYS2
uses: msys2/setup-msys2@v2 uses: msys2/setup-msys2@27b3aa77f672cb6b3054121cfd80c3d22ceebb1d #v2.20.1
with: with:
msystem: ${{ matrix.msys2_env }} msystem: ${{ matrix.msys2_env }}
update: true update: true
@ -56,7 +56,7 @@ jobs:
# text file and will not match the output from xzgrep. # text file and will not match the output from xzgrep.
run: git config --global core.autocrlf false run: git config --global core.autocrlf false
- uses: actions/checkout@v3 - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 #v4.1.0
######################## ########################
@ -118,7 +118,7 @@ jobs:
############### ###############
# Upload the test logs as artifacts if any step has failed. # Upload the test logs as artifacts if any step has failed.
- uses: actions/upload-artifact@v3 - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 #v3.1.3
if: ${{ failure() }} if: ${{ failure() }}
with: with:
name: ${{ matrix.msys2_env }} ${{ matrix.build_system }} Test Logs name: ${{ matrix.msys2_env }} ${{ matrix.build_system }} Test Logs