naveensrinivasan opened a new pull request #34163: URL: https://github.com/apache/spark/pull/34163
### What changes were proposed in this pull request? Pinning github actions to a SHA ### Why are the changes needed? Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies ### Does this PR introduce _any_ user-facing change? Running github action and checking the SHA with the existing repository ### How was this patch tested? Running the GitHub action -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
