<@UUL0G62B1> here's the mental hold up on merging ...
# atmos-deve
Erik Osterman (Cloud Posse)
04/06/2026, 9:29 PM@RB here's the mental hold up on merging this: https://github.com/cloudposse/atmos/pull/2123/changes#r3041795730
Erik Osterman (Cloud Posse)
04/06/2026, 9:30 PMr
RB
04/06/2026, 9:31 PMI’d say only bump github action shas to versions via trusted bots, no humans, that way bump-prs should always be pointing to real upstream version commits
RB
04/06/2026, 9:32 PMWe could then force any non-bot-PRs (human prs) to also pin but those SHAs would need to be manually verified
RB
04/06/2026, 9:33 PMAnother option is to have an action or bot that will always ensure the base branch and changes to the base branch will always have verified github action SHA pins
e
Erik Osterman (Cloud Posse)
04/06/2026, 9:36 PMOkay, that's a good point. I didn't realize this PR was not from you.
Erik Osterman (Cloud Posse)
04/06/2026, 9:40 PM(not that I don't trust you!! haha)
😏 1
r
RB
04/06/2026, 9:40 PM“you” is interesting here cause technically I spawned that PR from step security’s onboarding page, however, the official author of the PR seems to be step-security-bot 🙂
e
Erik Osterman (Cloud Posse)
04/06/2026, 9:40 PMYeah, but I think the PR is originating from them.
2 Views