Update Ruby setup action to use version v1 #57
Conversation
dyoung522
had a problem deploying
to
workflow-test
GitHub Actions
Failure
There was a problem hiding this comment.
Pull request overview
This PR updates the ruby/setup-ruby GitHub Action from a pinned SHA with version comment to using the v1 version tag across two workflow jobs (test and audit).
Changes:
- Replaced SHA-pinned action reference (ee2113536afb7f793eed4ce60e8d3b26db912da4 # v1.127.0) with version tag (@v1) for easier maintenance
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # Add or replace dependency steps here | ||
| - name: Install Ruby and gems | ||
| uses: ruby/setup-ruby@ee2113536afb7f793eed4ce60e8d3b26db912da4 # v1.127.0 | ||
| uses: ruby/setup-ruby@v1 |
There was a problem hiding this comment.
Changing from a pinned SHA to a version tag reduces security. The previous approach using a pinned SHA (ee2113536afb7f793eed4ce60e8d3b26db912da4) with a version comment (v1.127.0) follows GitHub's security best practices for Actions. SHA pinning prevents potential supply chain attacks where a tag could be moved to point to malicious code. Consider reverting to SHA pinning or, if you prefer tags for easier updates, use a specific version tag like 'v1.127.0' instead of the moving 'v1' tag.
| uses: actions/checkout@v3 | ||
| - name: Install Ruby and gems | ||
| uses: ruby/setup-ruby@ee2113536afb7f793eed4ce60e8d3b26db912da4 # v1.127.0 | ||
| uses: ruby/setup-ruby@v1 |
There was a problem hiding this comment.
Changing from a pinned SHA to a version tag reduces security. The previous approach using a pinned SHA (ee2113536afb7f793eed4ce60e8d3b26db912da4) with a version comment (v1.127.0) follows GitHub's security best practices for Actions. SHA pinning prevents potential supply chain attacks where a tag could be moved to point to malicious code. Consider reverting to SHA pinning or, if you prefer tags for easier updates, use a specific version tag like 'v1.127.0' instead of the moving 'v1' tag.
No description provided.