Mastodon Feed
Boosted by andrewnez ("Andrew Nesbitt"):
mudge@ruby.social wrote:
Had a pleasant morning this week running our GitHub Actions through https://zizmor.sh/ Not only to pin all action versions (see also https://github.com/suzuki-shunsuke/pinact) but to be explicit about token permissions, restrict which steps have access to secrets, prevent persisted credentials leaking into artefacts, and reconsider what is and isn’t safe to run on self-hosted runners.
(Thanks to @andrewnez for drawing my attention to it.)