Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CI: Hashpin sensitive actions and install dependabot #226

Merged
merged 2 commits into from
Nov 14, 2023
Merged

CI: Hashpin sensitive actions and install dependabot #226

merged 2 commits into from
Nov 14, 2023

Conversation

diogoteles08
Copy link
Contributor

Closes #225

I've configured dependabot to work the same way as you requested in microsoft/TypeScript#56211

@jakebailey jakebailey merged commit f749018 into microsoft:main Nov 14, 2023
6 checks passed
@jakebailey
Copy link
Member

Based on #227, this was missing some pipelines, it seems; oops.

@diogoteles08
Copy link
Contributor Author

Hi @jakebailey, not sure I understood what you meant on your last comment, can you clarify what was missing?

@jakebailey
Copy link
Member

See 095b6a0, this PR forgot CI.yml.

@diogoteles08
Copy link
Contributor Author

Oh I see.
I left the CI.yml unpinned because it didn't access to any secrets or write permissions, so having it unpinned shouldn't bring any real security threat, and the flexibility of unpinned dependencies can be useful sometimes. But having all actions hash-pinned is not a problem at all 😄.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jakebailey jakebailey jakebailey approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Suggest an dependabot to keep GitHub Actions updated
2 participants
@diogoteles08 @jakebailey