Pin GitHub actions by sha #2865
Description
As a best practice, we should pin actions we use by commit SHA. This is the case for some workflows in the organization but not all. This issue is there to track updating those workflow and enable this settings.
Note: with dependabot, it doesn't require too much to update those as dependabot knows how to update.
- List workflows that are not using full commit SHA
- Update them
- Enable that setting
Metadata
Metadata
Assignees
Labels
No labels