jbampton commented on PR #508: URL: https://github.com/apache/openoffice/pull/508#issuecomment-6200687404
> Why the change to [.pre-commit-config.yaml](https://github.com/apache/openoffice/pull/508/changes/c45edc22e2536a416ef5d0d7a50feffed0dbe61e#diff-63a9c44a44acf85fea213a857769990937107cf072831e1a26808cfde9d096b9) To increase supply chain security mainly. Apache Airflow and Apache Shiro both pin their hooks: https://github.com/apache/airflow/blob/main/.pre-commit-config.yaml#L62 https://github.com/apache/shiro/blob/main/.pre-commit-config.yaml#L77 From Google below --- Pinning pre-commit hooks to a full-length commit SHA instead of a mutable tag or branch name makes your development and CI/CD pipelines immutable, secure, and reproducible. Key Reasons to Pin to SHA • Immutability: Tags (like v1 or v3.19.1) are just movable pointers. A publisher can delete, overwrite, or re-target a tag to a brand-new commit at any time, whereas a 40-character commit SHA points to one exact, unchangeable snapshot of code. • Supply-Chain Security: If an attacker compromises a third-party hook repository and pushes malicious code to an existing release tag, any developer or pipeline using that tag will automatically execute the malicious payload. SHA-pinning insulates you from this risk. • Guaranteed Reproducibility: Using branch names or tags means the code can drift quietly over time, causing builds or lint checks that passed yesterday to fail or behave differently today. A SHA ensures every developer on the team and every CI runner executes the exact same code. • Keeping Comments for Readability: You can pin the exact SHA while keeping the version tag as a comment for human readability • Easy Automation: You don't have to look up SHAs manually. Running pre-commit autoupdate --freeze will automatically update your hooks and lock them to their latest commit SHAs. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
