Context
Security review; fixed in PR #28.
Problem
softprops/action-gh-release (which receives the release github-token) was pinned to the mutable @v3 tag. A moved
tag or compromised maintainer account would run attacker code with that token. Inconsistent with setup-uv /
setup-pixi, which were already SHA-pinned.
Affected locations
| File |
Location |
actions/release/github/action.yml |
uses: softprops/action-gh-release@v3 |
Fix (PR #28)
Pin to commit 3d0d9888cb7fd7b750713d6e236d1fcb99157228 (# v3.0.2).
Severity / Effort
Medium · XS
Definition of Done
Context
Security review; fixed in PR #28.
Problem
softprops/action-gh-release(which receives the releasegithub-token) was pinned to the mutable@v3tag. A movedtag or compromised maintainer account would run attacker code with that token. Inconsistent with
setup-uv/setup-pixi, which were already SHA-pinned.Affected locations
actions/release/github/action.ymluses: softprops/action-gh-release@v3Fix (PR #28)
Pin to commit
3d0d9888cb7fd7b750713d6e236d1fcb99157228(# v3.0.2).Severity / Effort
Medium · XS
Definition of Done
softprops/action-gh-releasereferenced by a 40-char commit SHA with a# vX.Y.Zcomment