Unverified85% confidenceFactTime unknown
GitHub官方安全指南推荐在GitHub Actions中锁定到commit SHA以规避标签被强制推送覆盖的供应链安全风险
1
Sources
85%
Confidence
Long-term
Relevance
5/31/2026
First Seen
Sources
setup-hd v0.0.78发布：GitHub Actions中高效下载工具的安装方案
twitterGitHubActions
Related Entities
Related Claims
UnverifiedGitHub官方安全最佳实践推荐使用完整commit SHA固定引用Action，以防范供应链攻击中的标签篡改风险89% similarUnverifiedExecuting code from untrusted sources is one of the most fundamental taboos in software security, and should be guarded against through measures such as code signing, package manager verification, and sandboxed execution.70% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/7611API
curl https://kongchang.com/api/v1/knowledge/claims/7611MCP
get_claim(id=7611)