Record GitHub action versions in code comment and remove timeouts#35
Conversation
Consistently keep track of the action version numbers, which will be recognized and kept updated by dependabot
|
Minimum allowed coverage is Generated by 🐒 cobertura-action against d1a2c4e |
The vmactions runners have been improved with retry logic, so let's remove the timeouts for now
rdmark
changed the title
|
|
I was wondering about these. Usually when I configure actions I use the tag, e.g. - uses: actions/checkout@v4What's the reasoning for using hashes instead of tags? |
|
Good question! The idea is that tags are mutable and therefore susceptible to supply chain attacks. So it adds a layer of control and transparency by pinning all dependencies (including CI runner dependencies) to hashes and then use dependabot, renovate or similar to manage updates. This is part of OpenSSF best practices, specifically this rule: https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies If you're curious, the OpenSSF scorecard as applied to my other project: https://scorecard.dev/viewer/?uri=github.com/Netatalk/netatalk If you like, I can set up a scorecard for bstring and see how many points we get. :) |
|
Sounds good to me if you want to spend the time! |
2 participants
Consistently keep track of the action version numbers, which will be recognized and kept updated by dependabot
Also, the vmactions runners have been improved with retry logic, so let's remove the timeouts for now