fix(configure-plugin): refresh stale version pins across configure skills#1476
Draft
laurigates wants to merge 1 commit into
Draft
fix(configure-plugin): refresh stale version pins across configure skills#1476laurigates wants to merge 1 commit into
laurigates wants to merge 1 commit into
Conversation
…ills Audited every version-pinned reference in the configuration skills and bumped stale pins to current upstream stable. Covers GitHub Action major tags (checkout v4->v6, upload-artifact v4->v7, setup-node/python v4/v5->v6, codeql v3->v4, docker/* v3/v5/v6->v4/v6/v7, release-please v4->v5, gitleaks-action v2->v3, getsentry/action-release v1->v3, setup-uv v4->v8, codecov v4->v6), pre-commit rev pins (pre-commit-hooks v6, ruff v0.15.15, gitleaks v8.30.1, biome v2.4.16, conventional-pre-commit v4.4.0, actionlint v1.7.12, gruntwork v0.1.30), Docker base/service images (python 3.14, node 24 LTS, golang 1.26, rust 1.96, nginx 1.30, alpine 3.23, postgres 17, redis 8, rabbitmq 4), and runtime versions. Security-relevant: bumps aquasecurity/trivy-action off the SHA for 0.34.0, which falls inside the compromised range (0.0.1-0.34.2) from the March 2026 supply-chain attack, to v0.36.0 (ed142fd, post-incident verified safe). Refreshes modified/reviewed frontmatter dates on edited SKILL.md files.
Contributor
Plugin Compliance Review
Recommendations
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Audited every version-pinned reference in the
configure-pluginconfiguration skills (GitHub Action pins, pre-commitrev:pins, Docker base/service image tags, runtime versions, and package-manager tool versions) and bumped stale pins to current upstream stable. Verified against upstream release pages / Docker Hub. 27 files changed, a symmetric 207/207 line swap (pure version replacements).The audit was fanned out across a team of six subagents, each owning a disjoint set of files; all findings were then reviewed against the actual
git diffbefore committing.What changed
GitHub Actions (major tags)
actions/checkoutv4 → v6,setup-nodev4 → v6,setup-pythonv5 → v6actions/upload-artifact/download-artifactv4 → v7,actions/cachev4 → v5configure-pagesv5 → v6,upload-pages-artifactv3 → v5,deploy-pagesv4 → v5dependency-review-actionv4 → v5,github/codeql-actionv3 → v4docker/setup-buildxv3 → v4,docker/loginv3 → v4,docker/metadatav5 → v6,docker/build-pushv6 → v7googleapis/release-please-actionv4 → v5,gitleaks/gitleaks-actionv2 → v3getsentry/action-releasev1 → v3,codecov/codecov-actionv4 → v6,astral-sh/setup-uvv4 → v8pre-commit
rev:pinspre-commit-hooksv5 → v6,ruff-pre-commit→ v0.15.15,gitleaksv8.22.1 → v8.30.1biomejs/pre-commit→ v2.4.16 (+@biomejs/biome1.9.4 → 2.4.16),conventional-pre-commitv4.3.0 → v4.4.0,actionlintv1.7.7 → v1.7.12,gruntwork-iov0.1.29 → v0.1.30Docker images / runtimes
🔒 Security-relevant
aquasecurity/trivy-actionSHA-pin moved off0.34.0— which falls inside the compromised range (0.0.1–0.34.2) from the March 2026 trivy supply-chain attack — tov0.36.0(ed142fd0673e97e23eac54620cfb913e5ce36c25, post-incident, verified to resolve to the v0.36.0 tag).Frontmatter
modified:/reviewed:dates refreshed to 2026-06-01 on editedSKILL.mdfiles.Left intentionally unchanged
pre-commit/mirrors-prettierv4.0.0-alpha.8— repo archived (Apr 2024); no stable v4 exists.trufflesecurity/trufflehog@main,dtolnay/rust-toolchain@stable— intentional floating refs.ruff>=0.8.0,pytest>=8.0,typescript ^5.7.0, etc.) — minimum constraints, not stale pins.Follow-up worth a maintainer's eye (not changed here)
configure-workflows/REFERENCE.mdcontains aclaude-sonnet-4-20250514model ID in aclaude-code-actionexample — a stale model reference (current isclaude-sonnet-4-6). Left as-is since model IDs are a different category from package version pins; flagging in case you'd like it updated.🤖 Generated with Claude Code
Generated by Claude Code