Hugo van Kemenade personal blog
Lock Your GitHub Actions
Because GitHub Actions are fetched from Git, the previous advice was to pin to a full SHA instead of a tag. This is because tags are mutable and susceptible to supply-chain attacks where an attacker points a previously safe tag at malicious code.
- Points
- 318
- HN comments
- 62
- Submissions
- 1
- Cited by
- 0 commenters
Security & PrivacyInfrastructure & DevOps2026
On Hacker News
| Submitted | Title on HN | Points | Comments |
|---|---|---|---|
| Nov 11, 2026 | Lock Your GitHub Actions by gslin | 318 | 62 |
