Yes, I scratched my head trying to understand what this accomplishes. It just puts a tag back instead of a SHA but now moves the SHA (locked in) to a separate file that now needs to be verified ?
I fail to see how this is better or needed.
replyYou can still use the SHA if you want to. What it achieves is transitive pinning (which this post doesn't properly highlight).
replyLack of transitive pinning support was the biggest supply-chain security criticism against GHA and I'm glad they are finally tackling it!
SHA pinning on GitHub does not always imply account pinning, even where the account name is explicitly specified along with it.
replySo some of the extra steps are meaningful. Though I am still not convinced they could not have been implemented in a deliberately backwards-incompatible way to Github action in general, keeping the syntax and removing only the special case that is never both intentional and non-malicious at the same time.
Enforced through GitHub Actions that is :)
reply