Update - #565
Conversation
|
Older C++ is used on purpose. First, there is no need to force newer, secondly last time we tried it caused cleo and plugins be reported as malware by most of the scanners on Virust Total. |
I tested, even some plugins have less detections, same on cleo.asi. |
|
|
||
| - name: Pack archive | ||
| if: ${{ hashFiles('preview_changes.md') != '' }} | ||
| uses: thedoctor0/zip-release@b57d897cb5d60cb78b51a507f63fa184cfe35554 # 0.7.6 |
There was a problem hiding this comment.
sticking to a specific commit SHA was done on purpose, to avoid possible chain attacks
There was a problem hiding this comment.
sticking to a specific commit SHA was done on purpose, to avoid possible chain attacks
Hundreds of projects using these actions, i think that will be one chance in a billion if we consider that these projects are open sourced + GitHub protections and developer community.
There was a problem hiding this comment.
it does not matter, it may happen to any project
https://www.theregister.com/security/2025/03/17/github-supply-chain-attack-spills-secrets-from-23k-projects/1192629
https://thehackernews.com/2026/05/github-actions-supply-chain-attack.html
There was a problem hiding this comment.
It is also an official recommendation from GitHub https://docs.github.com/en/actions/reference/security/secure-use?learn=getting_started#using-third-party-actions
There was a problem hiding this comment.
it does not matter, it may happen to any project https://www.theregister.com/security/2025/03/17/github-supply-chain-attack-spills-secrets-from-23k-projects/1192629
Well, i can pin to the specific version but, that will be also risky if there is some security issue is found in our pinned version and it fixed in newer version, we must track it every time.
There was a problem hiding this comment.
it does not matter, it may happen to any project https://www.theregister.com/security/2025/03/17/github-supply-chain-attack-spills-secrets-from-23k-projects/1192629
Well, i can pin to the specific version but, that will be also risky if there is some security issue is found in our pinned version and it fixed in newer version, we must track it every time.
Correct, but this can be done in a controlled manner, rather than just accepting any latest change.
There was a problem hiding this comment.
I forgot to mention that full SHA is enforced on repo-level
There was a problem hiding this comment.
I
Ok, should i pin every action or exclude official ones?
There was a problem hiding this comment.
I would rather not change actions at all. If it works, don't touch it
There was a problem hiding this comment.
I would rather not change actions at all. If it works, don't touch it
Well, this PR completely opposes your quote lol, everything works and there is no any new features or fixes lol. However, GitHub wants from us to update some of them due to deprecation of node.js 20 on actions, so we should update them.
It happens after people start to download it. It is binary totally different file, once one AV mark it as malware avalanche starts, as others just copy their homework. Do people really believe all vulnerabilities are introduced in first version, then every following update just removes them? |
|
Pinned the actions, and migrated to new .slnx format. |
3 participants
Tested, works fine.