Comment Comment by zygentoma Sorry, no.When I check out code from a git repository in a pipeline using a git hash, I expect the code to be exactly what has been reviewed by me under that hash.Everything else would just be a crazy invitation to make supply chain attacks uncircumventable. parent zygentoma 1 month ago
When I check out code from a git repository in a pipeline using a git hash, I expect the code to be exactly what has been reviewed by me under that hash.
Everything else would just be a crazy invitation to make supply chain attacks uncircumventable.