Uncategorized
GitHub Actions & Security: Best practices 
Rob Bos 06 Feb, 2021
Share 
Rob wanted to double check how GitHub Actions use SemVer for their versioning system, and he found more idiosyncrasies again: How GitHub Actions versioning works
TL;DR:
The runner just downloads what you specified, by getting it from the tag
The runner does not do SemVer at all. It’s up to the maintainer
Even GitHub does not update (or create) all SemVer versions, so @v3 is not necessarily the latest thing for v3!
The marketplace shows releases, not tags. If the maintainer does not actually release, it’s not visible
by Rob Bos
Rob has a strong focus on ALM and DevOps, automating manual tasks and helping teams deliver value to the end-user faster, using DevOps techniques. This is applied on anything Rob comes across, whether it’s an application, infrastructure, serverless or training environments. Additionally, Rob focuses on the management of production environments, including dashboarding, usage statistics for product owners and stakeholders, but also as part of the feedback loop to the developers. A lot of focus goes to GitHub and GitHub Actions, improving the security of applications and DevOps pipelines. Rob is a Trainer (Azure + GitHub), a Microsoft MVP and a LinkedIn Learning Instructor.