Последние новости
Российская пенсионерка купила золота на 19 миллионов рублей14:50
Стало известно возможное наказание Верке Сердючке в России20:50。新收录的资料是该领域的重要参考
You can SHA-pin the top-level action, but Palo Alto’s “Unpinnable Actions” research documented how transitive dependencies remain unpinnable regardless. The tj-actions/changed-files incident in March 2025 started with reviewdog/action-setup, a dependency of a dependency, and cascaded outward when the attacker retagged all existing version tags to point at malicious code that dumped CI secrets to workflow logs, affecting over 23,000 repos. GitHub has since added SHA pinning enforcement policies, but only for top-level references.，更多细节参见新收录的资料
—Christoph Blindenbacher, Director, ThinkPad Product Management。关于这个话题，新收录的资料提供了深入分析
Why is this interesting to me: Lambda (alpha) egraphs.