Feature
buf-action downloads binaries from GitHub releases. An attacker may replace the binaries for previous releases with malicious payloads, meaning that pinning the version input without also specifying checksum is insufficient to avoid supply chain attacks.
It would be great if you could enable immutable releases in GitHub.
It might also be worth considering enabling immutable tags in Docker Hub for fully-qualified version numbers (i.e. tags matching ^\d+\.\d+\.\d+$)?
Feature
buf-actiondownloads binaries from GitHub releases. An attacker may replace the binaries for previous releases with malicious payloads, meaning that pinning theversioninput without also specifyingchecksumis insufficient to avoid supply chain attacks.It would be great if you could enable immutable releases in GitHub.
It might also be worth considering enabling immutable tags in Docker Hub for fully-qualified version numbers (i.e. tags matching
^\d+\.\d+\.\d+$)?