pin github action versions #740
Description
LiteLLM was comprimised recently - BerriAI/litellm#24512. The original attack vector was picking up an updated github action.
Best practice is to pin (via SHA) the versions of github actions and then review carefully when updating (noting that not-updating can also leave security holes open...)
Need to formulate a policy and review process
- dependabot can help by creating a PR when a version updates -- but if this is accepted automatically it may defeat the objective
- plugins like harden-security can help limit what an action can do (such as extracting and sending credentials)