Skip to content

OIDC examples don't pin external actions (& don't declare them) #34316

Description

@janbrasna

Code of Conduct

What article on docs.github.com is affected?

  1. https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-google-cloud-platform#requesting-the-access-token
  2. https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#requesting-the-access-token
  3. https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-azure#requesting-the-access-token
  4. https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-hashicorp-vault#requesting-the-access-token
  5. https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-pypi#updating-your-github-actions-workflow

What part(s) of the article would you like to see updated?

    steps:
    - id: 'auth'
      name: 'Authenticate to GCP'
      uses: 'google-github-actions/[email protected]'
      with:

should pin a hash instead, also the reusable disclaiming 3rdparty usage should be added.

Additional information

This is analogous for all the pages mentioned, for both # Requesting and # Revoking examples.

Metadata

Metadata

Assignees

No one assigned

    Labels

    SME reviewedAn SME has reviewed this issue/PRactionsThis issue or pull request should be reviewed by the docs actions teamcontentThis issue or pull request belongs to the Docs Content teamhelp wantedAnyone is welcome to open a pull request to fix this issuenever-staleDo not close as stale

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions