ci: cargo release pin version #51
Conversation
joncinque
left a comment
joncinque
left a comment
There was a problem hiding this comment.
Up to you, but it would probably be easier to just use https://github.com/taiki-e/cache-cargo-install-action to install cargo-release -- what do you think?
Has anyone audited that plugin yet? (I also could). It doesn't appear very widely-adopted yet. 15 stars. |
|
If you want more stars, you can use https://github.com/taiki-e/install-action instead 😅 |
It's not that I specifically want more stars, I am just generally apprehensive about introducing third-party actions that can access publishing secrets without good reason. Even adding Is there some major drawback to just pinning the installation version for now? |
joncinque
left a comment
joncinque
left a comment
There was a problem hiding this comment.
I am just generally apprehensive about introducing third-party actions that can access publishing secrets without good reason
Note that the action doesn't have access to publishing secrets, that's only added to the steps that need it.
Is there some major drawback to just pinning the installation version for now?
No big drawbacks, it's just easier (we don't have to remember to bump the version in the future) and faster (downloading a binary vs compiling it).
But again, it's not a big deal, and it's totally up to you
Patching this for now: