Project benefits: impostor-commit and ref-confusion

[ericcornelissen]

I was reading the zizmor docs and came across the terms impostor-commit and ref-confusion and realized ghasum helps protect against both of these. The latter is - I think - kinda obvious and partly the point of this project ("As an added benefit, it can also be used as an alternative to in-workflow commit SHA.".

The former though is more interesting and something I had forgotten about. In short, GitHub threats a repository and its fork as a single network, the result being that GitHub Actions may fetch commits from forks even when you specify the original repository's name. In the imposter-commit example the commit c7d749a2d57b4b375d1ebcd17cfbfb60c676f18e does not belong to the actions/checkout repository. ghasum protects against this "problem"(/unexpected feature) because it will only consider exactly the repositories specified in the uses: directive.

In light of this, it might make some sense to document the "benefits" of this project in addition to its Limitations.