Travis to GA

[prisae]

No description provided.

[coveralls]

Coverage increased (+9.0e-05%) to 99.933% when pulling 128197a on travis-to-GA into 82c4730 on master.

[AndreMiras]

Why not using the tag directly?

        uses: AndreMiras/coveralls-python-action@v20201129

[prisae]

For security reasons. If your GitHub is compromised, someone could delete your release v20201129, create another release with the tag v20201129, and put malicious code in it. At least that is how I understood this:

pypa/gh-action-pypi-publish#27

I got a lot of my Action-yaml-ideas from https://github.com/fatiando/boule/blob/master/.github/workflows/pypi.yml - so @leouieda looked probably deeper into this issue and will correct me ;-)

[AndreMiras]

Very interesting idea indeed, I've never thought about it. I would never go that far even though it makes sense what you say.
Thanks for sharing

[prisae]

I guess the important / more extensive link is in the comment of the GitHub issue I posted: https://julienrenaux.fr/2019/12/20/github-actions-security-risk/

[leouieda]

Yeah, I’m a bit paranoid 🙂 I don’t much like the idea of giving a token to any action author out there. Not that I think you’re malicious @AndreMiras. But there are a lot of actions and I find it worrisome that GitHub has no control over this. It’s inevitable that someone will make an action at some point that steals tokens.

[AndreMiras]

I understand your concern, isn't computer security all about being paranoid?
It's also about finding the right balance between security and productivity while keeping in mind the risk (impact/likelihood).
I for now prefer to keep it simple and readable with the tag, but I'm happy this potential flaw got brought to my attention 😃

[leouieda]

You're absolutely right about needing a balance. For me, I've decided to use the commit hash whenever giving a token to an Action. I'm also not too worried about the official GitHub actions.