From 9c8960a9031cd9ed3987d69c3a214f52cd16c14a Mon Sep 17 00:00:00 2001 From: Diogo Teles Sant'Anna Date: Fri, 29 Dec 2023 16:13:42 -0300 Subject: [PATCH 1/2] Hashpin sensitive dependency at bzlmod-archive.yml --- .github/workflows/bzlmod-archive.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/bzlmod-archive.yml b/.github/workflows/bzlmod-archive.yml index 0c117ffd8..a6b5e788f 100644 --- a/.github/workflows/bzlmod-archive.yml +++ b/.github/workflows/bzlmod-archive.yml @@ -12,7 +12,7 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - run: git archive -o "${{ format('{0}-{1}.tar.gz', github.event.repository.name, github.event.release.tag_name) }}" HEAD - run: gh release upload ${{ github.event.release.tag_name }} *.tar.gz env: From 359c437dcd0719b3951f08850a813c2ea24a0e50 Mon Sep 17 00:00:00 2001 From: Diogo Teles Sant'Anna Date: Fri, 29 Dec 2023 16:14:56 -0300 Subject: [PATCH 2/2] Configure dependabot to update actions --- .github/dependabot.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..2390d8c80 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,10 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "monthly" + groups: + github-actions: + patterns: + - "*"