Security vulnerabilities and automated fixes for cwe 829 issues
1 post found
The `bench-probe.yml` workflow referenced a GitHub Action by a mutable tag or branch name instead of a full commit SHA, leaving the pipeline exposed to supply-chain attacks if the action owner's tag were ever repointed. The fix pins the action to an immutable 40-character commit SHA, closing the same class of gap exploited in the real-world trivy-action and kics-github-action compromises.