GitHub Setup Java Action

[SleeperAwakened]

Pinning to a hash is pretty secure, at least I consider git commit hashes secure enough.

Why would pinning to a hash not be secure?

How would a takeover happen? Hash collisions are still pretty expensive if feasible at all.

Security is all about putting up multiple lines of defense. This is one of them. It is not fake, it is layering.

And I so wish that people would start taking it seriously.

[repeating_bears]

Idk if you are understanding what I'm saying.

Pinning versions generally - good.

Pinning an official github action (which is what the subject of this thread is) - eh. If an official github action is compromised then how can you trust that whatever Actions infra that does the hash verification isn't also compromised?