From d573361e32f66e3e38e52f705f361963c19d8bba Mon Sep 17 00:00:00 2001 From: GitHub Security Bot <88103841+github-security-bot@users.noreply.github.com> Date: Thu, 10 Sep 2026 17:30:49 -0400 Subject: [PATCH 1/2] Pin GitHub Actions to commit SHAs --- .github/dependabot.yml | 6 ++++++ .github/workflows/approve-or-deny-request.yml | 8 ++++---- .github/workflows/initialize-request.yml | 8 ++++---- .github/workflows/pr.yml | 6 +++--- .github/workflows/test.yml | 4 ++-- 5 files changed, 19 insertions(+), 13 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e32ca04..1201051 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -5,6 +5,12 @@ version: 2 updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + cooldown: + default-days: 7 - package-ecosystem: "npm" # See documentation for possible values directory: ".github/scripts/" # Location of package manifests schedule: diff --git a/.github/workflows/approve-or-deny-request.yml b/.github/workflows/approve-or-deny-request.yml index b1d78cb..5164744 100644 --- a/.github/workflows/approve-or-deny-request.yml +++ b/.github/workflows/approve-or-deny-request.yml @@ -15,7 +15,7 @@ jobs: payload: ${{ steps.issue_body_parser_request.outputs.payload }} steps: - name: Get JSON Data out of Issue Request - uses: peter-murray/issue-body-parser-action@v3 + uses: peter-murray/issue-body-parser-action@6f0770bae810c272cbdccf6f817b0759a9d82647 # v3.0.0 id: issue_body_parser_request with: github_token: ${{ secrets.GITHUB_TOKEN }} @@ -43,9 +43,9 @@ jobs: echo "VERSION: $VERSION" echo "version=$VERSION" >> $GITHUB_OUTPUT - name: Check out scripts - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Setup Node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '20' check-latest: true @@ -54,7 +54,7 @@ jobs: cd .github/scripts npm install - name: Approve or deny request - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 env: VERSION: ${{ steps.get_version.outputs.version }} REPO: ${{ fromJson(needs.parse-issue.outputs.payload).repo }} diff --git a/.github/workflows/initialize-request.yml b/.github/workflows/initialize-request.yml index b8e648b..910d63c 100644 --- a/.github/workflows/initialize-request.yml +++ b/.github/workflows/initialize-request.yml @@ -15,7 +15,7 @@ jobs: payload: ${{ steps.issue_body_parser_request.outputs.payload }} steps: - name: Get JSON Data out of Issue Request - uses: peter-murray/issue-body-parser-action@v3 + uses: peter-murray/issue-body-parser-action@6f0770bae810c272cbdccf6f817b0759a9d82647 # v3.0.0 id: issue_body_parser_request with: github_token: ${{ secrets.GITHUB_TOKEN }} @@ -47,9 +47,9 @@ jobs: echo "VERSION: $VERSION" echo "version=$VERSION" >> $GITHUB_OUTPUT - name: Check out scripts - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Setup Node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '20' check-latest: true @@ -58,7 +58,7 @@ jobs: cd .github/scripts npm install - name: Create the repo ${{ fromJson(needs.parse-issue.outputs.payload).repo }}_${{ steps.get_version.outputs.version }} on GitHub Enterprise Server - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 env: VERSION: ${{ steps.get_version.outputs.version }} OWNER: ${{ fromJson(needs.parse-issue.outputs.payload).owner }} diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index a8bd6f8..a2e29fd 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -17,8 +17,8 @@ jobs: working-directory: ./.github/scripts steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '20' check-latest: true @@ -28,7 +28,7 @@ jobs: working-directory: ${{ env.working-directory }} - run: npm test working-directory: ${{ env.working-directory }} - - uses: tintef/nyc-reporter-action@0.2.5 + - uses: tintef/nyc-reporter-action@66a40cea2d02fdb0ac8fa045a7355cbbf9b991a1 # 0.2.5 with: GITHUB_TOKEN: ${{ github.token }} SKIP_COVERAGE_FOLDER: true diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index c0e0d3e..5bf957c 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -12,8 +12,8 @@ jobs: env: working-directory: ./.github/scripts steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 20 cache: npm From 448947fd3af1bdadd8cdc66d2fefa5293eccfb9d Mon Sep 17 00:00:00 2001 From: Rob Anderson Date: Tue, 15 Sep 2026 13:06:07 -0700 Subject: [PATCH 2/2] don't add back the nyc-reporter-action --- .github/workflows/pr.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index a8649d5..65f1c4a 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -28,8 +28,3 @@ jobs: working-directory: ${{ env.working-directory }} - run: npm test working-directory: ${{ env.working-directory }} - - uses: tintef/nyc-reporter-action@66a40cea2d02fdb0ac8fa045a7355cbbf9b991a1 # 0.2.5 - with: - GITHUB_TOKEN: ${{ github.token }} - SKIP_COVERAGE_FOLDER: true - WORKING_DIRECTORY: ${{ env.working-directory }}