gemini-code-assist[bot] commented on code in PR #19703:
URL: https://github.com/apache/tvm/pull/19703#discussion_r3383649892
##########
.github/actions/build-wheel-for-publish/action.yml:
##########
@@ -64,7 +64,7 @@ runs:
# ---- Install LLVM via conda (cache miss only) ----
- name: Setup conda
if: steps.llvm-cache.outputs.cache-hit != 'true'
- uses:
conda-incubator/setup-miniconda@8ee1f361103df19b6f8c8655fd3967a8ecb162d5 #
v4.0.1
+ uses: conda-incubator/[email protected]
Review Comment:
Pinning third-party actions by a full-length commit SHA is a security best
practice recommended by GitHub. Unlike tags, which are mutable and can be
updated or spoofed to point to malicious code, commit SHAs are immutable.
Reverting from SHA pinning to version tags increases the risk of supply chain
attacks. It is highly recommended to retain the SHA-pinned reference and use an
inline comment to document the human-readable version tag.
```yaml
uses:
conda-incubator/setup-miniconda@8ee1f361103df19b6f8c8655fd3967a8ecb162d5 #
v4.0.1
```
##########
.github/actions/build-wheel-for-publish/action.yml:
##########
@@ -73,7 +73,7 @@ runs:
- name: Setup conda (retry with tar.bz2)
if: steps.llvm-cache.outputs.cache-hit != 'true' && steps.conda1.outcome
== 'failure'
- uses:
conda-incubator/setup-miniconda@8ee1f361103df19b6f8c8655fd3967a8ecb162d5 #
v4.0.1
+ uses: conda-incubator/[email protected]
Review Comment:
Pinning third-party actions by a full-length commit SHA is a security best
practice recommended by GitHub. Unlike tags, which are mutable and can be
updated or spoofed to point to malicious code, commit SHAs are immutable.
Reverting from SHA pinning to version tags increases the risk of supply chain
attacks. It is highly recommended to retain the SHA-pinned reference and use an
inline comment to document the human-readable version tag.
```yaml
uses:
conda-incubator/setup-miniconda@8ee1f361103df19b6f8c8655fd3967a8ecb162d5 #
v4.0.1
```
##########
.github/actions/build-wheel-for-publish/action.yml:
##########
@@ -55,7 +55,7 @@ runs:
# ---- Cache LLVM prefix ----
- name: Cache LLVM
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+ uses: actions/[email protected]
Review Comment:
Pinning third-party actions by a full-length commit SHA is a security best
practice recommended by GitHub. Unlike tags, which are mutable and can be
updated or spoofed to point to malicious code, commit SHAs are immutable.
Reverting from SHA pinning to version tags increases the risk of supply chain
attacks. It is highly recommended to retain the SHA-pinned reference and use an
inline comment to document the human-readable version tag.
```yaml
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
```
##########
.github/actions/setup/action.yml:
##########
@@ -1,13 +1,13 @@
runs:
using: "composite"
steps:
- - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+ - uses: actions/[email protected]
Review Comment:
Pinning third-party actions by a full-length commit SHA is a security best
practice recommended by GitHub. Unlike tags, which are mutable and can be
updated or spoofed to point to malicious code, commit SHAs are immutable.
Reverting from SHA pinning to version tags increases the risk of supply chain
attacks. It is highly recommended to retain the SHA-pinned reference and use an
inline comment to document the human-readable version tag.
```yaml
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
```
##########
.github/actions/setup/action.yml:
##########
@@ -19,7 +19,7 @@ runs:
python-version: "3.10"
condarc-file: tests/conda/condarc
conda-remove-defaults: true
- - uses:
conda-incubator/setup-miniconda@8ee1f361103df19b6f8c8655fd3967a8ecb162d5 #
v4.0.1
+ - uses: conda-incubator/[email protected]
Review Comment:
Pinning third-party actions by a full-length commit SHA is a security best
practice recommended by GitHub. Unlike tags, which are mutable and can be
updated or spoofed to point to malicious code, commit SHAs are immutable.
Reverting from SHA pinning to version tags increases the risk of supply chain
attacks. It is highly recommended to retain the SHA-pinned reference and use an
inline comment to document the human-readable version tag.
```yaml
- uses:
conda-incubator/setup-miniconda@8ee1f361103df19b6f8c8655fd3967a8ecb162d5 #
v4.0.1
```
##########
.github/actions/build-wheel-for-publish/action.yml:
##########
@@ -108,7 +108,7 @@ runs:
# ---- Build and test wheels ----
- name: Build and test wheels
- uses: pypa/cibuildwheel@298ed2fb2c105540f5ed055e8a6ad78d82dd3a7e # v3.3.1
+ uses: pypa/[email protected]
Review Comment:
Pinning third-party actions by a full-length commit SHA is a security best
practice recommended by GitHub. Unlike tags, which are mutable and can be
updated or spoofed to point to malicious code, commit SHAs are immutable.
Reverting from SHA pinning to version tags increases the risk of supply chain
attacks. It is highly recommended to retain the SHA-pinned reference and use an
inline comment to document the human-readable version tag.
```yaml
uses: pypa/cibuildwheel@298ed2fb2c105540f5ed055e8a6ad78d82dd3a7e #
v3.3.1
```
##########
.github/actions/setup/action.yml:
##########
@@ -1,13 +1,13 @@
runs:
using: "composite"
steps:
- - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+ - uses: actions/[email protected]
env:
CACHE_NUMBER: 2
with:
path: ~/conda_pkgs_dir
key: ${{ runner.os }}-conda-${{ env.CACHE_NUMBER }}-${{
hashFiles('ci/scripts/package/build-environment.yaml') }}
- - uses:
conda-incubator/setup-miniconda@8ee1f361103df19b6f8c8655fd3967a8ecb162d5 #
v4.0.1
+ - uses: conda-incubator/[email protected]
Review Comment:
Pinning third-party actions by a full-length commit SHA is a security best
practice recommended by GitHub. Unlike tags, which are mutable and can be
updated or spoofed to point to malicious code, commit SHAs are immutable.
Reverting from SHA pinning to version tags increases the risk of supply chain
attacks. It is highly recommended to retain the SHA-pinned reference and use an
inline comment to document the human-readable version tag.
```yaml
- uses:
conda-incubator/setup-miniconda@8ee1f361103df19b6f8c8655fd3967a8ecb162d5 #
v4.0.1
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
