deps: Pin compnerd/gha-setup-vsdevenv to SHA #22
Conversation
Some security policies require all external GitHub Actions to be pinned to a specific SHA. This typically also applies to transitive dependencies. Usage of `dsaltares/fetch-gh-release-asset` is already pinned, so pinning the only other GHA allows for safely pinning this action as well.
|
Hello 👋🏼 and thank you for your work on creating this github action! I realize this is a change you may not be interested in supporting, and no worries if that is the case. But before I forked it to satisfy a compliance requirement, I thought I would run it by you. LMK and once again, thank you for your open source contributions! |
|
Hmm, what do you think of this instead? I can roll a release of gha-setup-vsdevenv, and then we pin to that release revision instead? I think that pinning to a random revision that is "main" is less than ideal. |
Sounds great to me. Thank you so much! |
Some security policies require all external GitHub Actions to be pinned
to a specific SHA. This typically also applies to transitive
dependencies.
Usage of
dsaltares/fetch-gh-release-assetis already pinned, sopinning the only other GHA allows for safely pinning this action as
well.