How should you reference a third-party action to guard against supply-chain tampering?

Question

Accepted Answer

Pin the action to a full-length commit SHA rather than a tag, since tags are mutable and movable — Pinning to a full commit SHA is immutable, unlike a tag that can be moved to malicious code — a signed tag is still a movable ref, forking upstream is heavy-handed (and forks can update), and vendoring source is not a supported way to reference actions.

Answer

Pin the action to a signed release tag rather than a branch, since signed tags can never be altered

Answer

Fork the action into your own organization rather than using upstream, since forks receive no updates

Answer

Vendor the action source into your own repository rather than referencing it, since copies never change

How should you reference a third-party action to guard against supply-chain tampering?

Why this is the answer

More CI/CD with GitHub Actions flashcards