Tag: supply-chain
-
Stop using @v4: pin your GitHub Actions to a commit SHA
Tags can be moved, commit hashes can’t. One line in almost every workflow is a quiet supply-chain risk, and the fix takes a minute.
Tags can be moved, commit hashes can’t. One line in almost every workflow is a quiet supply-chain risk, and the fix takes a minute.