Skip to content

Comments

CI: Hashpin sensitive actions and install dependabot#226

Merged
jakebailey merged 2 commits intomicrosoft:mainfrom
diogoteles08:ci/hashpin-sensitive-actions
Nov 14, 2023
Merged

CI: Hashpin sensitive actions and install dependabot#226
jakebailey merged 2 commits intomicrosoft:mainfrom
diogoteles08:ci/hashpin-sensitive-actions

Conversation

@diogoteles08
Copy link
Contributor

Closes #225

I've configured dependabot to work the same way as you requested in microsoft/TypeScript#56211

@jakebailey jakebailey merged commit f749018 into microsoft:main Nov 14, 2023
@jakebailey
Copy link
Member

Based on #227, this was missing some pipelines, it seems; oops.

@diogoteles08
Copy link
Contributor Author

Hi @jakebailey, not sure I understood what you meant on your last comment, can you clarify what was missing?

@jakebailey
Copy link
Member

See 095b6a0, this PR forgot CI.yml.

@diogoteles08
Copy link
Contributor Author

Oh I see.
I left the CI.yml unpinned because it didn't access to any secrets or write permissions, so having it unpinned shouldn't bring any real security threat, and the flexibility of unpinned dependencies can be useful sometimes. But having all actions hash-pinned is not a problem at all 😄.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Suggest an dependabot to keep GitHub Actions updated

2 participants