From 45a36f9b751511406bf269f9a484576c7a94af71 Mon Sep 17 00:00:00 2001
From: Andrea Peruffo <andrea.peruffo1982@gmail.com>
Date: Mon, 23 Jan 2023 15:25:40 +0000
Subject: [PATCH] Use commit SHA instead of branch name for third-party actions
Hi!
Following the [GH Action Security Hardening](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions) guide we should use the commit SHA instead of the `branch` or `tag` for any third-party untrusted action.
---
.github/workflows/release.yml | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index be29191..1104586 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,7 +18,8 @@ jobs:
- run: yarn install
working-directory: ./spectral
- name: Inject slug/short variables
- uses: rlespinasse/github-slug-action@v4
+ # v4
+ uses: rlespinasse/github-slug-action@a362e5fb42057a3a23a62218b050838f1bacca5d
- name: Validate Tag
working-directory: ./spectral
run: yarn semver $GITHUB_REF_SLUG