Vulnerability

Current usage of 3rd-party actions in .github/workflows uses broad versions instead of specific commit hashes, example:

Though unlikely, this exposes the project to supply chain attacks in case latest major version is compromised at the time of workflow run.

Solution

Pinning all 3rd party actions to commit hash corresponding to latest stable release, example:

- name: Setup pnpm
  uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2
  # Pinned to commit hash of release v4.0.0 on 05/07/24.