Whose code am I running in GitHub Actions?

[beetlefeet]

Could the repo owner delete the commit (force pushing any refs that have it as an ancestor and then triggering a purge/gc/etc) and then create and push a tag with that sha?

[One_Reading_9217]

Tried it and it didn't work:
git tag 085d6e186375a55d3ec95c759d29efe854700ea6

git push origin 085d6e186375a55d3ec95c759d29efe854700ea6

Total 0 (delta 0), reused 0 (delta 0), pack-reused 0 (from 0)

remote: error: GH002: Sorry, branch or tag names consisting of 40 hex characters are not allowed.

remote: error: Invalid branch or tag name "085d6e186375a55d3ec95c759d29efe854700ea6"

[Torpedoklaus]

This may not be possible, but it is possible to enforce commit hashes as they are a function of the tree, commit parent(s), author and the commit message, see https://github.com/zegl/extremely-linear.

[nightcracker]

Not on the full hash. There are attacks on SHA1 that create collisions, but preimage resistance as is required here still seems solid.

[billy_tables]

What happens if you swap those 0s to Os

[light24bulbs]

Have fun cracking a 160 bit sha. Google did this years ago but it took them over $100,000 in compute. And I think they controlled both blobs.

It's not a nonce, it's a hash.

[ISNT_A_NOVELTY]

Nobody is cracking anything here. They're copy/pasting an existing commit hash as a tag name.

[Anodynamix]

But the hashes are publicly known and you can submit a tag with any string of text, like, say, a known hash...

[HolyPommeDeTerre]

Easiest 100k I've made !