John Bampton 4c7ecbb8a6 refactor: only use certified GitHub Actions to increase security ...

Official -> "The individual jobs in a workflow can interact with (and compromise) other jobs. For example, a job querying the environment variables used by a later job, writing files to a shared directory that a later job processes, or even more directly by interacting with the Docker socket and inspecting other running containers and executing commands in them.

This means that a compromise of a single action within a workflow can be very significant, as that compromised action would have access to all secrets configured on your repository, and can use the GITHUB_TOKEN to write to the repository. Consequently, there is significant risk in sourcing actions from third-party repositories on GitHub. "

https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#using-third-party-actions

2021-02-13 16:13:30 +10:00

..

build.yml

Update GitHub Actions.

2021-02-12 21:14:06 +09:00

codeql-analysis.yml

Remove "skip ci" hack to GitHub Actions [skip travis][skip appveyor]

2021-02-12 19:44:41 +09:00

lint.yml

refactor: only use certified GitHub Actions to increase security

2021-02-13 16:13:30 +10:00

oss-fuzz.yml

Remove "skip ci" hack to GitHub Actions [skip travis][skip appveyor]

2021-02-12 19:44:41 +09:00

spell-checker.yml

Use git ls-files instead of find in spell-checker.yml [ci skip]

2020-12-20 22:52:33 +09:00