サプライチェーン攻撃対策
cool down期間を設ける
これを使う
The --uploaded-prior-to option allows you to filter packages by their upload time to an index, only considering packages that were uploaded before a specified value. This can be useful for creating reproducible builds by ensuring you only install packages that were available at a known point in time.
pip自体の指定は最新 or 指定？
指定するなら四半期ごとにpipのバージョン指定箇所の更新が必要。
Github actionsで使われている場合
そもそもubuntu-latest上のPythonが使われていることも多いが、
これは非推奨のようだった。
The default version of Python or PyPy in PATH varies between runners and can be changed unexpectedly so we recommend always setting Python version explicitly using the python-version or python-version-file inputs.
actions/setup-python
を使う
actionsの指定はhash値で行う
以上