DevOps Community Sponsored by Cloud Posse

SweetOps

I also thought about this incident just now, and chat with ChatGPT, a good takeaway is do not use tag but the image SHA

this may help, <https://github.com/Hyland/github-actions-ensure-sha-pinned-actions>

<https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/>

Also, this can be enforced at the org level

image.png

awesome, I just wrote a github action, <https://github.com/snowsky/what-a-trivy-hack>, with help of codex

and tested at <https://github.com/snowsky/yourfinanceworks/actions/runs/23418339102>

in AI era, every code is like a snapchat message

just remember there is a movie named Limitless, cannot believe human can be that way of learning