Michael Heap (@mheap.dev)

The tj-actions/changed-files compromise prompted me to write up how I secure GitHub Actions workflows using SHAs without maintenance pain Go from insecure to security conscious in < 15 minutes, including configuring automatic updates through Dependabot or Renovate michaelheap.com/pin-your-git...

loading . . .

Pin your GitHub Actions Secure your GitHub Actions by pinning them to commit SHAs, preventing supply chain attacks. Learn how to automate updates and enforce best security practices. https://michaelheap.com/pin-your-github-actions/

8 months ago