Question

Your security team audits a workflow that uses a popular third-party action referenced as `uses: some-vendor/deploy-action@v3`. The team wants to protect the pipeline against a supply-chain attack in which the vendor's tag is repointed to a malicious commit, while still following GitHub's recommended practice for third-party actions. Which change should you make to the reference?

Accepted Answer

Pin the reference to a full 40-character commit SHA, e.g. `some-vendor/deploy-action@a1b2c3...`, optionally with the version as a trailing comment.

Answer

Change the reference to `some-vendor/deploy-action@main` so you always run the latest reviewed code.

Answer

Keep `@v3` but add `permissions: read-all` to the job so the action cannot cause harm.

Answer

Fork the action into your own repo and reference it as `your-org/deploy-action@v3` to trust the tag.