fix: Pinning github actions to SHA#827
Conversation
Signed-off-by: LAKSHJAIN14 <jainlaksh07@gmail.com>
NucleoFusion
left a comment
There was a problem hiding this comment.
I dont think these shas/digests are right.
Can you give me the command you ran for these?
Cause from what I gather, the command should be structured like,
gh api repos/sigstore/cosign-installer/git/refs/tags/v3.7.0 \
--jq '.object.sha'|
@NucleoFusion This is what I used and I am getting the same sha which is there on the release page as well 
I think what you are getting from that command is the sha of the annotated tag but for pinning in github action we need the commit SHA which is visible at the bottom left in the below image 
|
Signed-off-by: LAKSHJAIN14 <jainlaksh07@gmail.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #827 +/- ##
=========================================
- Coverage 10.99% 9.00% -1.99%
=========================================
Files 173 272 +99
Lines 8671 13441 +4770
=========================================
+ Hits 953 1211 +258
- Misses 7612 12115 +4503
- Partials 106 115 +9 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
NucleoFusion
left a comment
There was a problem hiding this comment.
lgtm
Thanks for the contribution!
|
@bupd friendly ping |
|
@NucleoFusion @LAKSHJAIN14 |
Description
pinning the github actions to SHA and commenting the version beside it
Type of Change
Please select the relevant type.