Elektrine lite

← Feed

@jonafato@mastodon.social

Post #776118

2026-03-25 14:19 UTC

Why is it that I keep seeing "everyone should pin their GitHub Actions versions to a SHA because that's the secure way to do it" and not "GitHub should build tooling that creates and manages Actions lockfiles by default"? Am I just missing that version and only seeing the former one boosted?

Replies (6)

  • @cthoyt@scholar.social 2026-03-25 14:39

    @jonafato@mastodon.social you should check out @andrewnez@mastodon.social on fedi and his blog, he's been writing about this topic a lot in the last few months

    Open ##2817069

  • @jonafato@mastodon.social relatedly from the trusted publishing docs https://docs.pypi.org/trusted-publishers/security-model/ GitHub Actions' own security model for OpenID Connect tokens is a little subtle: and furthermore (emphasis not mine): PyPI has protections in place to make some attacks against OIDC more difficult (like account resurrection attacks). However, like all forms of authentication, the end user is fundamentally responsible for applying it correctly. when pgp keys were removed from pypi, a lengthy justification was provided by the same engineer who developed the trusted publishing workflow regarding the difficulty in using them correctly (which was itself flawed but that's a separate topic). there are in these cases (as you note) no specific protections ensured, while alternatives are removed. it's a really upsetting tradeoff to provide to the community and it's a pattern of behavior that has advanced in recent years.

    Open ##2817074

  • @sdwilsh@social.ridetrans.it 2026-03-25 16:40

    @jonafato@mastodon.social That's because we all know getting GitHub to implement features like that is near impossible 😅

    Open ##2817075

  • @djspiewak@fosstodon.org 2026-03-25 19:20

    @jonafato@mastodon.social @ross@social.rossabaker.com I mean I agree with what you're saying, but maybe I'm missing something, because it feels like this type of tooling is almost trivial to implement yourself if you're willing to inline the locking and add some ignored YAML.

    Open ##2817077

  • @hugovk@mastodon.social 2026-03-25 20:51

    @jonafato@mastodon.social 2022: "We are building a new way to publish and consume actions that will improve the security of the CI/CD supply chain." 2025: closed as not planned https://github.com/actions/publish-immutable-action

    Open ##2817079

  • @jonafato@mastodon.social likely because one is something actionable by those it affects and the other is a (justifiable) opinion.  Hopes and prayers don't solve problems.

    Open ##2817080