Describe the solution you'd like
To improve supply chain security, we should pin all the versions we use in our dependencies, both github-action and Go.
Ideally the dependencies should specify the sha, but if it is not possible without degrading the experience too much then specifying the build number is an acceptable tradeoff.
Describe the solution you'd like
To improve supply chain security, we should pin all the versions we use in our dependencies, both github-action and Go.
Ideally the dependencies should specify the sha, but if it is not possible without degrading the experience too much then specifying the build number is an acceptable tradeoff.