Same thing I flagged in opencore — publish.yml references actions by mutable tag (actions/checkout@v4, actions/setup-go@v5, softprops/action-gh-release@v2, etc.), and this workflow holds contents: write and id-token: write, so a compromised tag would run with publish/release permissions.
I'd pin every uses: to a full commit SHA — same fix as newcore-network/opencore#68, worth doing consistently across both repos.
Split out from #19.
Same thing I flagged in opencore —
publish.ymlreferences actions by mutable tag (actions/checkout@v4,actions/setup-go@v5,softprops/action-gh-release@v2, etc.), and this workflow holdscontents: writeandid-token: write, so a compromised tag would run with publish/release permissions.I'd pin every
uses:to a full commit SHA — same fix as newcore-network/opencore#68, worth doing consistently across both repos.Split out from #19.