charleswiltgen__axiom/.github/dependabot.yml at main - charleswiltgen__axiom - GetSkill.work

skills/charleswiltgen__axiom

mirror of https://github.com/CharlesWiltgen/Axiom.git synced 2026-09-20 19:58:20 +08:00

Files

T

Charles Wiltgen 5791e1494e chore(ci): pin GitHub Actions to commit SHAs + add Dependabot (axiom-nwr)

Replace mutable tag refs with the latest commit SHA in each action's
current major version, with the tag preserved as a comment for human
readability:

- actions/checkout@v3 → @f43a0e5… # v3.6.0
- actions/setup-node@v4 → @49933ea… # v4.4.0
- actions/upload-pages-artifact@v3 → @56afc60… # v3.0.1
- actions/deploy-pages@v4 → @d6db901… # v4.0.5

Closes the supply-chain hole where a compromised maintainer could
silently swap action contents via a tag force-push.

Pin-only (no major-version upgrade) to avoid behavior surprises on the
docs deploy. Add .github/dependabot.yml so SHAs stay current weekly.

Found by: project security review 2026-05-09.

2026-05-09 11:54:27 -07:00

9 lines

156 B

YAML

Raw Permalink Blame History

 version: 2
 updates:
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: weekly
     commit-message:
       prefix: chore(ci)