setup-node icon indicating copy to clipboard operation
setup-node copied to clipboard

Published 20 hours ago • verified publisher icon actions

Securely pin node version

Open ned opened this issue 7 months ago • 1 comments

Description: Allow specifying the sha256 of the node binary in addition to the node version. If the asset fails to match the expected sha256, we should error. If specifying the sha256 is not feasible, we could allow specifying the git commit of the release (https://github.com/actions/node-versions/releases).

Justification: Ensure that any 3rd party code that runs in GitHub actions is locked down to known hashes.

Are you willing to submit a PR? Yes, once the details are ironed out.

ned avatar Mar 27 '25 02:03 ned