kyma-project / compass-manager / 35351012313
26%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 20
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 25.505%. Remained the same
35351012313

push

github

web-flow 
chore: pin GitHub Actions to commit SHAs (supply-chain hardening) (#614)

## Summary

- Pin all unpinned GitHub Actions version tags to full commit SHAs
across 8 workflow files
- Version tags retained as inline comments (e.g. `# v7`) for readability
- Addresses the supply-chain hardening audit finding: **Unpinned version
in GH Actions: 17x**

## Motivation

Using mutable version tags (e.g. `@v2`, `@main`) is a supply-chain risk
— if an upstream tag is moved to a malicious commit, the workflow
silently runs attacker-controlled code. Pinning to a full 40-character
commit SHA ensures the exact reviewed code is always used.

## Changes

| File | Actions pinned |
|------|---------------|
| `build-image.yaml` | `actions/checkout`,
`kyma-project/test-infra/image-builder.yml` |
| `daily-markdown-link-check.yaml` | `actions/checkout` |
| `golangci-lint.yaml` | `actions/checkout`, `actions/setup-go` |
| `pr-markdown-link-check.yaml` | `actions/checkout` |
| `release.yaml` | `softprops/action-gh-release` |
| `run-vuln-check.yaml` | `golang/govulncheck-action` |
| `tests.yaml` | `actions/checkout`, `actions/setup-go`,
`coverallsapp/github-action`, `actions/upload-artifact`,
`actions/download-artifact` |
| `upload-release-report.yaml` | `actions/download-artifact`,
`google-github-actions/auth`, `google-github-actions/setup-gcloud` |

Closes #576

720 of 2823 relevant lines covered (25.5%)

0.26 hits per line

Jobs
ID Job ID Ran Files Coverage
1 35351012313.1 20
25.5
 GitHub Action Run
Source Files on build 35351012313