Development record
abcd ahoy --remote can report the SHA-pinning advisory without its count of unpinned uses. The fidelity review of itd-2610290746077716 (rcp-6083de2cef52, ac-9 met with concerns) found that when any workflow or local action went unread, the switch takes the unread branch before the count branch, so the advisory names what was unread but drops the count of tag-referenced uses abcd did read (internal/core/ahoy/remote_baseline.go:913). An Actions answer that carries no sha_pinning_required field reads as unknown before the workflows are looked at (remote_baseline.go:911), so a repository with unpinned uses gets no advisory at all there.
abcd ahoy --remote can report the SHA-pinning advisory without its count of unpinned uses. The fidelity review of itd-2610290746077716 (rcp-6083de2cef52, ac-9 met with concerns) found that when any workflow or local action went unread, the switch takes the unread branch before the count branch, so the advisory names what was unread but drops the count of tag-referenced uses abcd did read (internal/core/ahoy/remote_baseline.go:913). An Actions answer that carries no sha_pinning_required field reads as unknown before the workflows are looked at (remote_baseline.go:911), so a repository with unpinned uses gets no advisory at all there.
Frontmatter
| id | iss-2610292103119559 |
|---|---|
| type | issue |
| lifecycle | open |
| severity | minor |
.abcd/work/issues/open/iss-2610292103119559-sha-pinning-advisory-can-drop-its.md
open on GitHub ↗ · commit history ↗
mentions1
- itd-2610290746077716abcd audits and applies a repository's GitHub settings