René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Change third party github actions to target specific commits rather than tags","articleBody":"We should pin our third party github actions to a specific commit, rather than a tag as we currently do.\n\nThis is a cybersecurity measure [recommended by GitHub](https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions):\n\u003e The individual jobs in a workflow can interact with (and compromise) other jobs. For example, a job querying the environment variables used by a later job, writing files to a shared directory that a later job processes, or even more directly by interacting with the Docker socket and inspecting other running containers and executing commands in them.\n\n\u003e This means that a compromise of a single action within a workflow can be very significant, as that compromised action would have access to all secrets configured on your repository, and may be able to use the GITHUB_TOKEN to write to the repository. Consequently, there is significant risk in sourcing actions from third-party repositories on GitHub. For information on some of the steps an attacker could take, see [Secure use reference](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#potential-impact-of-a-compromised-runner).\n\nIn our workflows, we have some third party actions used like such:\n```\n    - name: Install uv\n      uses: astral-sh/setup-uv@v7\n```","author":{"url":"https://github.com/olivialynn","@type":"Person","name":"olivialynn"},"datePublished":"2026-04-16T14:44:35.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/581/python-project-template/issues/581"}