mirror of
https://github.com/fastfetch-cli/fastfetch.git
synced 2026-09-13 02:42:09 +02:00
Thibaud-Vdb
b739dfee0b
A version tag like @v1 or a branch like @master is a movable pointer: whoever controls the action repository can re-point it, and the next run executes whatever it points at. Several of these actions run in jobs whose outputs ship to users: build-release.yml creates the GitHub release with the downloadable binaries, and build-windows-hosts.yml holds the SignPath signing token, so a re-pointed tag there could ship a tampered or wrongly signed release. This is exactly how the tj-actions/changed-files compromise propagated (CVE-2025-30066). Pinning by full commit SHA makes the reviewed code the code that runs, the same way docker/setup-qemu-action is already pinned in build-linux-vms.yml. Refs that pointed at master (cross-platform-actions, setup-alpine, get-latest-release) are pinned to their latest release tag. Every pin keeps a version comment, and each SHA was resolved from the upstream repository and cross-checked against its release tag.
22 lines
409 B
YAML
22 lines
409 B
YAML
name: Reusable Spellcheck
|
|
|
|
on:
|
|
workflow_call:
|
|
|
|
jobs:
|
|
spellcheck:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: checkout repository
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- name: Install codespell
|
|
shell: bash
|
|
run: |
|
|
pip3 install codespell
|
|
codespell --version
|
|
|
|
- name: Run Spellchecker
|
|
run: codespell
|