Skip to content

Commit fd7bd6b

Browse files
authored
Merge pull request #18351 from KyFaSt/clarify-immutable-actions-text
Clarify immutable actions help text
2 parents 659ec66 + 690924f commit fd7bd6b

File tree

1 file changed

+2
-3
lines changed

1 file changed

+2
-3
lines changed

actions/ql/src/Security/CWE-829/UnversionedImmutableAction.md

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,11 @@
22

33
## Description
44

5-
Using an immutable action without indicating proper semantic version will result in the version being resolved to a tag that is mutable. This means the action code can change between runs and without the user's knowledge. Using an immutable action with proper semantic versioning will resolve to the exact version
6-
of the action stored in the GitHub package registry. The action code will not change between runs.
5+
This action is eligible for Immutable Actions, a new GitHub feature that is currently only available for internal users. Immutable Actions are released as packages in the GitHub package registry instead of resolved from a pinned SHA at the repository. The Immutable Action provides the same immutability as pinning the version to a SHA but with improved readability and additional security guarantees.
76

87
## Recommendations
98

10-
When using [immutable actions](https://github.com/github/package-registry-team/blob/main/docs/immutable-actions/immutable-actions-howto.md) use the full semantic version of the action. This will ensure that the action is resolved to the exact version stored in the GitHub package registry. This will prevent the action code from changing between runs.
9+
For internal users: when using [immutable actions](https://github.com/github/package-registry-team/blob/main/docs/immutable-actions/immutable-actions-howto.md) use the full semantic version of the action. This will ensure that the action is resolved to the exact version stored in the GitHub package registry.
1110

1211
## Examples
1312

0 commit comments

Comments
 (0)