Implement Security Best Practices GH-200 Practice Questions (Page 6)

Questions 26–26

1. 26application · medium

   Your organization's security policy requires that all third-party actions be pinned to a full commit SHA. A developer wants to use a popular action but only knows the major version tag. What should you do?

   • ACopy the action's code into your repository and use it as a local action.
   • BFind the commit SHA that corresponds to the desired release and pin the action to that SHA.
   • CUse the action with the @v1 tag and rely on the GitHub Marketplace to ensure security.
   • DUse the action with the @main branch and add a comment noting the version.
   Reveal Solution Discussion Select an answer first