Fix markdown link checker action reference - #5653
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
Can we update the policy instead? We should be able to pin it to the sha. /cc @blowdart |
|
Ah the problem is the allow list of actions? That should be updated to limit on versions. So either the allow list needs updating to have the sha, or to just allow umbrelladocs/action-linkspector@*. Obviously being stricter and using the sha in the allow list is safer, however that would mean any time a workflow gets updated with a new version a repo admin will have to update the allow list, which is a huge toil. I'd suggest using the @* approach here as a compromise. |
|
@mmitche - Can you comment on the best way to proceed here? |
|
@blowdart I'm fine with that as long as these workflows never have anything but PR-read. |
|
Otherwise, a force-push of a tag can change behavior without review. |
4 participants
Problem
The Check Markdown Links workflow fails before creating any jobs because it pins
umbrelladocs/action-linkspectorto a commit SHA. The dotnet enterprise Actions policy only permits this action through theumbrelladocs/action-linkspector@v1reference.Solution
Change the action reference to the enterprise-allowed
@v1tag. Add a comment documenting that the tag is intentional and should not be replaced with a SHA unless the enterprise policy changes.