jdaugherty commented on PR #16025: URL: https://github.com/apache/grails-core/pull/16025#issuecomment-5122846331
> @jdaugherty @matrei we should pin all or nearly all of the actions. It is consistent and the most secure, if GitHub or and apache repo get hacked. For the github actions, the ASF does not require a pin so this isn't a concern. There hasn't been a case for this previously, and until the ASF reverses policy here we shouldn't try to complicate our setup more. As for our own actions (grails-github-actions), we already have problems doing reviews and we don't want to have to update everything + get reviews for our own action changes. I do not want to have the extra work here and we have to update them more often now that we're pinning docker images in those actions. I 100% disagree with pinning versions of our own code since that code has to be used already across all of our releases. For anything else, I 100% agree since they're external. If the platform is hacked, we have larger problems than the action itself. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
