Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.38%. Comparing base (83caa59) to head (1a19955).

@@           Coverage Diff           @@
##             main     #739   +/-   ##
=======================================
  Coverage   97.38%   97.38%           
=======================================
  Files           3        3           
  Lines        7690     7690           
=======================================
  Hits         7489     7489           
  Misses        201      201           

Flags with carried forward coverage won't be shown. Click here to find out more.

Pre-commit now fails, since zizmor complains about unpinned GitHub actions hashes. My opinion is still that this rule is not helpful for GitHub-maintained actions as hacked GitHub means a lot of trouble anyway. On the other hand, security fixes in the actions will not get propagated. I suggest we turn off that rule.

My opinion is still that this rule is not helpful for GitHub-maintained actions as hacked GitHub means a lot of trouble anyway.

hmm... while that's true, I feel like it would be quite easy for one of these repos specifically to be hacked without that causing problems for "the whole of GitHub more broadly? I assume there are specific developers in GitHub responsible for maintaining these repos who could get phished or have their machines compromised, etc.

Sure, but it's likely that these developers have access to more critical infrastructure than just single actions. And the point remains that relying on specific tags means that we're susceptible to security problems that got fixed in later versions.

My recommendation would be to hash-pin GitHub's first-party actions as well: GitHub's official guidance is to hash-pin everything, and rely on channels like Renovate or Dependabot for both periodic and security updates.

(Relatedly, it's worth noting that the GitHub Actions under actions/* are seemingly mostly maintainer by third-party contractors, who are often not marked as officially affiliated with GitHub on their profiles. The lack of transparency/consistency in provenance is one of the reasons zizmor changed to requiring all actions to be hash-pinned, rather than considering first-party ones safer by default.)

And the point remains that relying on specific tags means that we're susceptible to security problems that got fixed in later versions.

But we have dependabot configured on this repo, and dependabot will immediately file an out-of-schedule PR updating us to the latest version of a github action if that version is marked as fixing a security issue

(Oops, posted simultaneously with @woodruffw there before I saw his comment!)