Support ref in secure-checkout #1005
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added 3 commits
October 13, 2022 05:07
Signed-off-by: Ian Lewis <[email protected]>
Signed-off-by: Ian Lewis <[email protected]>
Signed-off-by: Ian Lewis <[email protected]>
ianlewis
requested review from
asraa,
laurentsimon and
joshuagl
as code owners
asraa
reviewed
Oct 13, 2022
| sha: | ||
| description: "The SHA to checkout." | ||
| ref: | ||
| description: "The ref or SHA to checkout." |
There was a problem hiding this comment.
nit: document that ref should be fully-formed in the form `refs/*, and that it can handle branches and tags.
currently it also handles pull requests. I'm not sure why that would be used in practice
There was a problem hiding this comment.
Documenting for later: we'll keep in branches, technically I think we only need it for tags and otherwise we're using sha
asraa
approved these changes
Oct 13, 2022
Signed-off-by: Ian Lewis <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Updates #968
This PR changes the
shainput forsecure-checkouttorefand allows passing git areforsha. The action now performs validation by looking up therefin the API and checking that the sha digest returned by the API and the sha checked out locally match. This may not necessarily satisfy the TLS interception issue brought up on #626 but at least makes it a little harder to fake a checkout.We need to support
refinsecure-checkoutbecause we need to be able to checkout the builder using a tag reference. This is because we recommend users call our workflows using a release tag.e.g.
This results in
detect-envaction returning something likerefs/tags/v1.2.0as the detected reference.