From 013ffd8d6a6736d4818afda2cf00079a2b38050f Mon Sep 17 00:00:00 2001 From: Wes Dean Date: Mon, 26 Aug 2024 15:22:46 -0400 Subject: [PATCH] Pin signing workflow processes --- .github/workflows/megalinter.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/megalinter.yml b/.github/workflows/megalinter.yml index b442ec45..b713a6ac 100644 --- a/.github/workflows/megalinter.yml +++ b/.github/workflows/megalinter.yml @@ -9,6 +9,7 @@ on: - main workflow_dispatch: + permissions: contents: read @@ -38,7 +39,7 @@ jobs: - name: "Import GPG key" id: import-gpg - uses: crazy-max/ghaction-import-gpg@v6 + uses: crazy-max/ghaction-import-gpg@01dd5d3ca463c7f10f7f4f7b4f177225ac661ee4 # pin@v6 with: gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }} passphrase: ${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}