setup-localstack icon indicating copy to clipboard operation
setup-localstack copied to clipboard

Published 20 hours ago • verified publisher icon localstack

Pin the the jenseng/dynamic-uses transitive GH Action dependency to a hash

Open MarkIannucci opened this issue 7 months ago • 0 comments

With the recent supply chain attack on a popular GH Action, I noticed that this action has a transitive dependency on jenseng/dynamic-uses (which is a really clever chunk of code!).

GitHub recommends pinning to a SHA to protect against these sorts of attacks which is what this PR does.

MarkIannucci avatar Mar 21 '25 05:03 MarkIannucci