Test artifactory-oidc - #791
Conversation
![semgrep-code-twilio[bot]](https://avatars.githubusercontent.com/u/109142?s=60&v=4){kind=small}
| - uses: twilio/sdk-actions/artifactory-oidc@dv/add-ruby-ecosystem | ||
| with: | ||
| ecosystem: ruby | ||
| - uses: ruby/setup-ruby@v1 |
There was a problem hiding this comment.
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
🍰 Fixed in commit 1a98cef 🍰
| id-token: write | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: twilio/sdk-actions/artifactory-oidc@dv/add-ruby-ecosystem |
There was a problem hiding this comment.
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
✨ Fixed in commit 1a98cef ✨
| contents: read | ||
| id-token: write | ||
| steps: | ||
| - uses: actions/checkout@v4 |
There was a problem hiding this comment.
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
🧁 Fixed in commit 1a98cef 🧁
1 participant
DO NOT MERGE.
Artifactory oidc test