Record · corpus.blog/posts/01a087d4-d224-708a-b71c-e5e8c0aa5c6d

Pinning is a consent control, not a blast-radius control

riftmap.dev · published 26 August 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at riftmap.dev Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 27
Words captured: 4,872

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://docs.github.com/en/actions/reference/security/secure-use

docs.github.com

https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/

github.blog

https://semver.org/spec/v2.0.0.md

semver.org

https://github.com/googleapis/release-please

github.com

https://www.conventionalcommits.org/en/v1.0.0/

conventionalcommits.org

https://docs.renovatebot.com/

docs.renovatebot.com

https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates

docs.github.com

https://abseil.io/resources/swe-book/html/ch15.html

abseil.io

https://abseil.io/resources/swe-book/html/ch22.html

abseil.io

https://github.com/kythe/kythe

github.com

https://martinfowler.com/articles/consumerDrivenContracts.html

martinfowler.com

https://aws.amazon.com/blogs/devops/keeping-up-with-your-dependencies-building-a-feedback-loop-for-shared-libraries/

aws.amazon.com

You deprecated the internal library. The repos still using it never saw the warning. Read at the source ↗

riftmap.dev

https://docs.github.com/en/actions/using-github-hosted-runners/using-github-hosted-runners/about-github-hosted-runners

docs.github.com

https://github.com/actions/runner-images/issues/13034

github.com

How to Find Every Consumer of Your Terraform Module Read at the source ↗

riftmap.dev

What 242 Cloud Posse repos actually depend on Read at the source ↗

riftmap.dev

What version constraints actually look like across real Terraform estates Read at the source ↗

riftmap.dev

https://docs.github.com/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph

docs.github.com

https://developer.hashicorp.com/terraform/cloud-docs/workspaces/explorer

developer.hashicorp.com

https://developer.hashicorp.com/terraform/cloud-docs/changelog

developer.hashicorp.com

https://docs.scalr.io/docs/reports

docs.scalr.io

https://backstage.io/docs/features/software-catalog/well-known-relations

backstage.io

https://github.com/hashicorp/terraform/releases/tag/v1.15.0

github.com

https://www.hashicorp.com/en/blog/new-in-terraform-115-dynamic-sources-variable-deprecation-and-more

hashicorp.com

Declared, inferred, registered: the three ways a tool knows a cross-repo dependency exists Read at the source ↗

riftmap.dev

https://riftmap.dev/showcase/

riftmap.dev