But how does that solve the issue with the forked action not using pinned versio... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

carlmr on May 8, 2025 | parent | context | favorite | on: How to harden GitHub Actions

But how does that solve the issue with the forked action not using pinned versions itself.

You need to recursively fork and modify every version of the GHA and do that to its sub-actions.

You'd need something like a lockgile mechanism to prevent this.

ratrocket on May 8, 2025 [–]

Yes, that is completely true -- transitive dependencies are a problem. What I suggested only works in the simplest cases and isn't a great solution, more of a bandaid.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact