ci: pin "actions/" GitHub Actions to SHAs

[kartben]

This commit follows up on e808ccf and completes the pinning of all
GitHub Actions to SHAs, including GitHub-owned actions/* actions.

Also update scorecard.yml versions in the process.

[fabiobaltieri]

Ok but what is the whole story? Like you pinned the hashes, now what? Do you expect us to audit the changes commit by commit when upgrading them? If we are just bumping them up to check that they are in the repo then this is pointless waste of time.

[pdgendt]

Ok but what is the whole story? Like you pinned the hashes, now what? Do you expect us to audit the changes commit by commit when upgrading them? If we are just bumping them up to check that they are in the repo then this is pointless waste of time.

We let dependabot check for updates, it will post a changelog alongside the changes. Still needs a minimal amount of effort though.
But only commits for tagged versions will be taken into account..

The issue with not using hashes is that tags are mutable, which happened for example with tj-actions/changed-files where all tags were set to a malicious version.

[fabiobaltieri]

Still needs a minimal amount of effort though. But only commits for tagged versions will be taken into account..

The issue with not using hashes is that tags are mutable, which happened for example with tj-actions/changed-files where all tags were set to a malicious version.

So the idea is that before approving such a change one is expected to through every commit, check the actual diff and look for signs of obfuscated exploits?

[nashif]

So the idea is that before approving such a change one is expected to through every commit, check the actual diff and look for signs of obfuscated exploits?

each sha would corrospond to a tag, so instead of using tags which can be exploited by making them point to a different sha, we take the sha directly. When approving/reviewing, it is going to be the same I guess, i.e. if you have checked the diff between tags before, you can do that, but I have never looked at diff between two tags when updating actions.

All of this as it was said already would be managed and proposed by depandabot, so less manual work hopefully.