alt Hacker NewsDoes this prevent one of the locked dependencies not locking their own dependencies and pulling in a malicious and replaced tag?
Does this prevent one of the locked dependencies not locking their own dependencies and pulling in a malicious and replaced tag?
It does not. Obviously if you lock a “foo/setup-latest-go” action, it’s still going to (and you’d probably expect it to) pull in the latest go. Actions are expected to start running though. Like GitHub isn’t gonna do an `npm install` for you, it’ll just run the entry point of the action, and the entry point can do whatever it was written to do.