Anyone who thinks hash pinning is a solution for supply chain attacks should look at what happened to #AquaSecurity’s #Trivy: pinning the hash was arguably key to the attack succeeding by making the payload blend in, with a hefty assist from the design flaw in #GitHub allowing commits to be referenced through a repo which doesn’t contain them.

Immutable tags are becoming table stakes.

https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23

#GitHubActions