chore(deps): bump the github-actions group across 1 directory with 8 updates #35
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: secure-workflows | |
| # Enforce SHA-pinning of every third-party action. Tag-pinning leaves us | |
| # vulnerable to upstream tag-rewrite attacks; SHA-pinning is the only way | |
| # to make the build reproducible and the supply chain auditable. | |
| # | |
| # This workflow fails the PR if any action under .github/workflows/ uses a | |
| # tag or branch instead of a commit SHA. PR-only — there is no value in | |
| # re-running this on the merge commit; if a tag-pinned action got past PR | |
| # review (admin bypass), `main`-side enforcement is still too late. | |
| # | |
| # Runs on EVERY PR (no paths filter), even those that don't touch | |
| # .github/workflows/**, because branch protection requires the | |
| # `ensure SHA-pinned actions` check and a path-filtered workflow that | |
| # doesn't trigger leaves the required check in "Expected" state forever | |
| # (blocking unrelated PRs from merging). The cost is ~5 seconds per PR. | |
| on: | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| ensure-sha-pinned: | |
| name: ensure SHA-pinned actions | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - uses: zgosalvez/github-actions-ensure-sha-pinned-actions@ca46236c6ce584ae24bc6283ba8dcf4b3ec8a066 # v5.0.4 |