From 3f4149b3245c0d1f251dde7aaea8376a67bdec34 Mon Sep 17 00:00:00 2001 From: Morgan Helton Date: Fri, 3 Apr 2026 09:28:00 -0500 Subject: [PATCH] chore: pin GitHub Actions to SHA Pin all external action references to immutable commit SHAs to mitigate supply chain attacks. Tracking: https://github.com/flox/product/issues/1302 Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/dependabot.yml | 6 ++++++ .github/workflows/ci.yml | 6 ++++-- 2 files changed, 10 insertions(+), 2 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..5ace460 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,6 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c01570d..c0d2fcc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -10,10 +10,12 @@ jobs: test: runs-on: "ubuntu-latest" steps: - - uses: "actions/checkout@v4" + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - name: "Install Flox" - uses: "flox/install-flox-action@main" + uses: flox/install-flox-action@dc880156f423b1b9f03534c3ccbb3bc3bb8c223e # main + - name: "Lint Go code" run: "flox activate -r flox/go -- go vet ./..."