Describe the feature
In this repository, GHA versions are pinned to SHAs to mitigate supply chain attacks. However, since there is no static analysis in place to verify this pinning, there is no guarantee that the versions remain fixed.
How about using a static analysis tool like pinact to ensure that SHA pinning is continuously verified within the CI pipeline?
Additional information
Describe the feature
In this repository, GHA versions are pinned to SHAs to mitigate supply chain attacks. However, since there is no static analysis in place to verify this pinning, there is no guarantee that the versions remain fixed.
How about using a static analysis tool like pinact to ensure that SHA pinning is continuously verified within the CI pipeline?
Additional information