A security audit identifies that a workflow uses 'uses: third-party/action@v2'. What is the security concern and recommended fix?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Tags are mutable git pointers — an attacker who compromises the action repo can point v2 at malicious code. A SHA is immutable.
Full explanation below image
Full Explanation
Git tags like '@v2' are mutable references — the action's repository maintainer (or a compromised account) can force-push the tag to point to different code containing malicious logic, and all workflows using '@v2' would silently run the new code. Pinning to a full commit SHA ('uses: third-party/action@a5ac7e51b41094c92402da3b24376905380afc29') is immutable — that hash will always refer to exactly the code you reviewed. '@latest' has the same problem as version tags. Internal forking is a valid but operational overhead approach. GITHUB_TOKEN compatibility has nothing to do with this security concern.