Pin GitHub Actions and add Dependabot workflow to update GitHub Actions #363

jcfr · 2025-04-30T22:31:36Z

Summary:

Add Dependabot workflow to update GitHub Actions
- https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference
- https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot#enabling-dependabot-version-updates-for-actions
Pin GitHub actions to full length commit SHA
- https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions

Working toward addressing:

Add support for Python 3.10, 3.11, 3.12 and 3.13 #350

GitHub's security hardening guide recommends this mitigation method. See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions

References: * https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference * https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot#enabling-dependabot-version-updates-for-actions

jcfr added 3 commits April 30, 2025 18:26

ci: Pin GitHub actions to full length commit SHA

a1390ee

GitHub's security hardening guide recommends this mitigation method. See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions

chore: Do not exclude changes associated with .github directory

f3a692a

jcfr enabled auto-merge (rebase) April 30, 2025 22:39

jcfr merged commit 5fcbbc3 into python-cmake-buildsystem:master Apr 30, 2025
15 checks passed

jcfr deleted the pin-github-actions-and-enable-dependabot branch April 30, 2025 22:46

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Pin GitHub Actions and add Dependabot workflow to update GitHub Actions #363

Pin GitHub Actions and add Dependabot workflow to update GitHub Actions #363

Uh oh!

jcfr commented Apr 30, 2025

Uh oh!

Uh oh!

Uh oh!

Pin GitHub Actions and add Dependabot workflow to update GitHub Actions #363

Pin GitHub Actions and add Dependabot workflow to update GitHub Actions #363

Uh oh!

Conversation

jcfr commented Apr 30, 2025

Uh oh!

Uh oh!

Uh oh!