alt Hacker NewsSo "SHA pinning with version reference in a comment" with extra steps, got it
Replies
OptionOfT • yesterday at 11:30 PM
Enforced through GitHub Actions that is :)
So "SHA pinning with version reference in a comment" with extra steps, got it
Enforced through GitHub Actions that is :)
Yes, I scratched my head trying to understand what this accomplishes. It just puts a tag back instead of a SHA but now moves the SHA (locked in) to a separate file that now needs to be verified ? I fail to see how this is better or needed.