Yes, true, but at least the fire won't spread through this one point. Hopefully ...

franktankbank · 2026-03-23T16:43:54

Doesn't a single compromised action in the chain cause the whole to be fucked? Pinning the top level doesn't prevent any spread.

teaearlgraycold · 2026-03-23T21:51:59

Might want to vendor everything?

lijok · 2026-03-23T23:06:12

That’s the way to go indeed. We’ve done it, not difficult, just a bit of gruntwork to keep them updated when needed

franktankbank · 2026-03-23T21:59:14

I don't know what this means in this context.

teaearlgraycold · 2026-03-23T22:45:42

Make copies of the entire GitHub action dependency tree.