slsa-github-generator
slsa-github-generator copied to clipboard
[bug] Strict input checking
GitHub actions don't validate that inputs were passed to an action even if the input is marked as required.
We should be more strict about input checking and produce errors if the inputs were not given.
For example, a call to secure-project-checkout-go could omit the go-version input even though it's required. This would result in an empty value being passed to setup-go which would install the "latest version" as determined by setup-go.
- name: Checkout the Go repository
uses: ./__BUILDER_CHECKOUT_DIR__/.github/actions/secure-project-checkout-go
with:
path: __PROJECT_CHECKOUT_DIR__