feat: hook review on label#344
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![semgrep-code-uniswap[bot]](https://avatars.githubusercontent.com/u/36115574?s=60&v=4){kind=small}
| fi | ||
|
|
||
| - uses: anthropics/claude-code-action@64c7a0ef71df67b14cb4471f4d9c8565c61042bf | ||
| - uses: anthropics/claude-code-action@v1 |
There was a problem hiding this comment.
An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. Github, foundry, and uniswap made github actions are exempt.
✨ Fixed in commit 7e9d7e5 ✨
| GH_TOKEN: ${{ github.token }} | ||
|
|
||
| - uses: anthropics/claude-code-action@64c7a0ef71df67b14cb4471f4d9c8565c61042bf | ||
| - uses: anthropics/claude-code-action@v1 |
There was a problem hiding this comment.
An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. Github, foundry, and uniswap made github actions are exempt.
🧼 Fixed in commit 7e9d7e5 🧼
2 participants
No description provided.