Skip to content

SEC-090: Automated trusted workflow pinning (2023-04-21) #175

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
nywilken merged 1 commit into from
Apr 21, 2023
Merged

SEC-090: Automated trusted workflow pinning (2023-04-21) #175

nywilken merged 1 commit into from
Apr 21, 2023

Conversation

@hashicorp-tsccr
Copy link
Contributor

@hashicorp-tsccr hashicorp-tsccr bot commented Apr 21, 2023

Hello,
This PR was auto-generated to pin the Actions workflow files in this repository to use trusted SHAs.
This is in support of RFC SEC-090 which is due to be implemented by EOQ2 FY24.

Please do the following:

  • Approve and merge this PR if you are happy with the changes.
  • Check if there are any untrusted third-party Actions in the workflow files and onboard them to the TSCCR.
  • The yaml comments "# TSCCR: no entry for repository..." or "# TSCCR: no version of..." in the workflow files identifies an untrusted Action.
  • If you have to onboard any third-party Actions, update and pin your workflows using the tsccr-helper tool after the Actions have been onboarded OR reach out to #team-prodsec and we can run this automation again.
  • Verify that your Actions are still working as expected after pinning.

Please reach out to #team-prodsec if you have any questions.

@hashicorp-tsccr hashicorp-tsccr bot requested a review from a team as a code owner April 21, 2023 11:22
@hashicorp-tsccr hashicorp-tsccr bot added SEC-090 Relating to RFC SEC-090. SEC-090/Pinning/Trusted Automated TSCCR pinning PR to trusted SHAs. labels Apr 21, 2023
nywilken
nywilken approved these changes Apr 21, 2023
View reviewed changes
Copy link
Contributor

@nywilken nywilken left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@nywilken nywilken merged commit 10b594a into main Apr 21, 2023
@nywilken nywilken deleted the tsccr-auto-pinning/trusted/2023-04-21 branch April 21, 2023 13:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@nywilken nywilken nywilken approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

SEC-090/Pinning/Trusted Automated TSCCR pinning PR to trusted SHAs. SEC-090 Relating to RFC SEC-090.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@nywilken