Describe the feature
GitHub Actions referenced by mutable tags (e.g. actions/checkout@v6) are vulnerable to supply-chain attacks: anyone with write access to the action's repository can force-push the tag to point at malicious code, and consumers will silently pull it on the next workflow run.
Also, actions/checkout@v5 is quite outdated (the latest is @7), so I will update it to the latest version as well.
Additional information
Describe the feature
GitHub Actions referenced by mutable tags (e.g.
actions/checkout@v6) are vulnerable to supply-chain attacks: anyone with write access to the action's repository can force-push the tag to point at malicious code, and consumers will silently pull it on the next workflow run.Also, actions/checkout@v5 is quite outdated (the latest is @7), so I will update it to the latest version as well.
Additional information