24
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 20 Sep 2026
24 points (96.2% liked)
TechTakes
2733 readers
389 users here now
Big brain tech dude got yet another clueless take over at HackerNews etc? Here's the place to vent. Orange site, VC foolishness, all welcome.
This is not debate club. Unless it’s amusing debate.
For actually-good tech, you want our NotAwfulTech community
founded 3 years ago
MODERATORS
Fwiw a similar problem is well-known in e.g. GitHub Actions even without this confusion.
You can have your GHA scripts use "actions" written by other people, and the way you refer to them is
user/repo@commit, where the commit can be a commit ID or a branch name or a tag name. The docs actually recommend pinning to commit IDs, but in practice most people actually pin to tags, likebob/doit@v1because that will auto-update if bob fixes some bug and updates v1 to point to that. But if bob goes rogue, or gets compromised, the attacker could change the tag v1 to point to a malicious commit, though, hence the recommendation to use commit IDs for all actions that you didn't write yourself. I don't know if this ref/ID confusion can be exploited on GHA, but I would expect the answer is no, because GitHub Actions doesn't launch git shell commands like a savage, but idk