Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[HPR-1248] .github/workflows: Replace untrusted GHA in repo workflows #12530

Merged
merged 1 commit into from
Jul 21, 2023
Merged

[HPR-1248] .github/workflows: Replace untrusted GHA in repo workflows #12530

merged 1 commit into from
Jul 21, 2023

Conversation

nywilken
Copy link
Contributor

@nywilken nywilken commented Jul 21, 2023 •
edited
Loading

The GHA action used for adding comments or labels to issues untrusted by TSCCR
have been replaced with an approved set of actions. The updated workflows use
actions/github-script for adding comments or labels to an issue.

Related to: https://github.com/hashicorp/security-tsccr/pull/608

Note:
https://github.com/bflad/action-migrate-issue is more recently updated, and looks reasonable to trust / use.

@nywilken
.github/workflows: Replace untrusted GHA in repo workflows
d3d315f 
The GHA action used for adding comments or labels to issues untrusted by TSCCR
have been replaced with an approved set of actions. The updated workflows use
actions/github-script for adding comments or labels to an issue.

Related to: https://github.com/hashicorp/security-tsccr/pull/608
@nywilken nywilken requested a review from a team as a code owner July 21, 2023 10:09
@nywilken nywilken added the tech-debt Issues and pull requests related to addressing technical debt or improving the codebase label Jul 21, 2023
@nywilken nywilken changed the title .github/workflows: Replace untrusted GHA in repo workflows [HPR-1248] .github/workflows: Replace untrusted GHA in repo workflows Jul 21, 2023
lbajolet-hashicorp
lbajolet-hashicorp approved these changes Jul 21, 2023
View reviewed changes
Copy link
Contributor

@lbajolet-hashicorp lbajolet-hashicorp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@nywilken nywilken merged commit 682f2e7 into main Jul 21, 2023
@nywilken nywilken deleted the nywilken/outdated-actions branch July 21, 2023 21:37
This was referenced Jul 24, 2023
Closed
Closed
@github-actions
Copy link

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Aug 21, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@lbajolet-hashicorp lbajolet-hashicorp lbajolet-hashicorp approved these changes

Assignees
No one assigned
Labels
tech-debt Issues and pull requests related to addressing technical debt or improving the codebase
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@nywilken @lbajolet-hashicorp