{"repo":"koalalab-inc/pinny","free":true,"listed":false,"github":"https://github.com/koalalab-inc/pinny","clone":"git clone https://github.com/koalalab-inc/pinny.git","description":"Pin your 3rd Party Github Actions and Docker Images dependencies.","language":"Go","stars":16,"topics":["cicd","dependency-security","docker-security","github-actions","supply-chain-security","security-tools"],"license":"Apache-2.0","category":"deployment-docker-iac","readme_excerpt":"Pinny Hash-pinning for your OSS dependencies to protect against repojacking and imposter commits. Pinny currently supports pinning Dockerfiles and Github Actions workflows. Why Software supply chain attacks are on the rise, with 742% increase in new-age supply chain attacks from 2019-2022. The use of OSS dependencies opens up organizations to a lot of software supply chain attack vectors like repojacking and dependency confusion. Automated hash-pinning is a practice that helps against such attacks. Hash-Pinning: OSS images can be referenced by image tags or hashes/digest. Images referenced by tag are mutable. The maintainer could push a new image with the same TAG and all downstream application using that image and TAG could break. Images referenced by hash are immutable. Even if there is a new image pushed with the same tag, the new image will have a new hash/digest. The previous image can still be referenced by the previous hash. Contents Example Pinning Github Actions workflows Pinning Dockerfiles Usage Github Actions Dockerfiles Installation Docker image Precompiled binary Example: #### Pinning Github Actions workflows ##### Sample run on the Github workflows of Akto Github repository #### Pinning Dockerfiles ##### Sample run on the Dockerfile of Metabase Github repository Usage: #### Github Actions To pin your Github Actions workflows, run the following command in your repository root. This will transform all the workflows in your repository to use pinned versions of the","default_branch":null,"files":null,"tree":[],"storefront":"/r/koalalab-inc","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/koalalab-inc/pinny/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}