alt Hacker NewsQuoting someone else's blog I've forgotten but you're trading the trust in the repo owner not moving a tag for trusting whoever merges the commit hash to have checked that's a release in the repo you want and not _some_ forks commit. All forks on github are the same repo you can pin any commit, merged upstream or not.
IMO Github should make Immutable tags mandatory to publish on https://github.com/marketplace
Replies
One could write an action that executes a shell script that does docker pull abc:latest.
As the consumer of an action that becomes really hard to find out unless I take the whole codebase apart.
Why not make the marketplace published tags immutable instead like others do?
That’s exactly what lockfiles are intended to avoid!
I almost forgot about that completely outrageous treatment of forks -- just bonkers.
Actions lockfiles prevent this. They won't allow you to lock an impostor commit, which is the right default.
(The previous way to provide general actions immutability, i.e. hash-pinning, had this issue and thus required additional checks.)