Clojurians Log v2

See https://github.com/seancorfield/honeysql/pull/605 and the CVE linked from that. I'm not sure how worried to be about that sort of thing...

I don't use GitHub actions but this is the sort of thing I worry about. I read about the tj-actions vulnerability at the time, there's a good follow-up post here: https://www.wiz.io/blog/github-actions-security-guide

Yeah, and GitHub's own docs do recommend pinning actions to SHAs, and warn about tags being movable.

The Wiz post also points out that pinning SHAs does not protect against transitive dependencies, but it's a good start...

Right, the bottom line is you have to be comfortable with a given version (or range) that you select, and it's on you to check all the dependencies—which is true of every library we casually add to our deps.edn files too...

I was not comfortable with trusting Microsoft with my secrets in the first place...

Currently, for work, we use GitLab OIDC to deploy to AWS so we don't need to give GitLab long-lived credentials, but we do trust GitLab to sign a JWT that allows pipelines to retrieve temporary credentials. I've been wondering if we could improve on this by using https://www.runatlantis.io/ to do the actual deployment, and if so if we could lock down Atlantis only to deploy signed commits. Not sure my colleagues would go along with that, though, as I think I'm the only person signing commits at the moment.

Even with such a setup, when it comes to supply chain attacks we'd have to worry about the terraform providers, which are also other people's code running with credentials in the environment.

Sorry, I'm thinking out loud and rambling a bit, security is always a can of worms and you have to make compromises somewhere along the line if you're going to get anything done.

Yeah, the only credentials I have with GitHub are for Clojars so, worst case, an account takeover could deploy malicious versions of anything I could deploy myself... which is actually quite a lot... so the impact could be very real. I'll probably switch to SHAs for actions—I'm pretty sure antq can still figure out updates on those...

Given most of my GHAs are from GitHub themselves, I feel fairly comfortable with that. I think I only use one "community" action (delaguardo's setup-clojure).