mirror of
https://github.com/fastfetch-cli/fastfetch.git
synced 2026-09-13 02:42:09 +02:00
Thibaud-Vdb
b739dfee0b
A version tag like @v1 or a branch like @master is a movable pointer: whoever controls the action repository can re-point it, and the next run executes whatever it points at. Several of these actions run in jobs whose outputs ship to users: build-release.yml creates the GitHub release with the downloadable binaries, and build-windows-hosts.yml holds the SignPath signing token, so a re-pointed tag there could ship a tampered or wrongly signed release. This is exactly how the tj-actions/changed-files compromise propagated (CVE-2025-30066). Pinning by full commit SHA makes the reviewed code the code that runs, the same way docker/setup-qemu-action is already pinned in build-linux-vms.yml. Refs that pointed at master (cross-platform-actions, setup-alpine, get-latest-release) are pinned to their latest release tag. Every pin keeps a version comment, and each SHA was resolved from the upstream repository and cross-checked against its release tag.