Pin GitHub Actions to commit SHAs and configure Dependabot#555
Conversation
Pin all action references in workflows to immutable commit SHAs (with version tags preserved as comments) to comply with the repository's security policy and mitigate tag-tampering risks. Also add Dependabot configuration to keep the pinned SHAs updated weekly via grouped pull requests.
k8s-ci-robot
added
the
cncf-cla: yes
k8s-ci-robot
added
tide/merge-method-squash
|
@zylxjtu: GitHub didn't allow me to assign the following users: rzlink. Note that only kubernetes-sigs members with read permissions, repo collaborators and people who have commented on this issue/PR can be assigned. Additionally, issues/PRs can only have 10 assignees at the same time. DetailsIn response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: msft-linliu, zylxjtu The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
4 participants
Pin all action references in workflows to immutable commit SHAs (with version tags preserved as comments) to comply with the repository's security policy and mitigate tag-tampering risks. Also add Dependabot configuration to keep the pinned SHAs updated weekly via grouped pull requests.