Unpinned tag for a non-immutable Action in workflow

[aurexav]

https://github.com/hack-ink/rust-initializer/security/code-scanning/13

Suggest making the release immutable.

[Swatinem]

The link does not work for me, is it a private repo?

Otherwise, can you point me to some docs on how to make tags/releases immutable? AFAIK, git tags are mutable, and the actions docs even suggest using tags (rather than branches) for things like v2, which I have always found weird.

On your end, you can always just point to a specific git sha instead.

[aurexav]

The link does not work for me, is it a private repo?

Otherwise, can you point me to some docs on how to make tags/releases immutable? AFAIK, git tags are mutable, and the actions docs even suggest using tags (rather than branches) for things like v2, which I have always found weird.

On your end, you can always just point to a specific git sha instead.

I hope I can avoid checking the commit every time I update, as some famous actions already support this, such as actions@checkout.

https://docs.github.com/en/actions/how-tos/create-and-publish-actions/using-immutable-releases-and-tags-to-manage-your-actions-releases

1. Go to the project "Setting"
2. Check the "Enable release immutability"
3. I think that's all.

[Ay1tsMe]

Bumping.

Following the recent Trivy supply chain compromise, I believe this should be a high priority. It has been abundantly clear that this should occur on all GitHub actions as a defense-in-depth measure to prevent tampering with GitHub actions if a future supply chain compromise occurs. Can this be done?

Reference: Preventing changes to your releases