From 38013ea5c8863418898d0b0f87f2a100f0a0dfea Mon Sep 17 00:00:00 2001 From: rsimpson2 Date: Sat, 14 Feb 2026 13:54:45 -0500 Subject: [PATCH 1/3] fix: pin GitHub Actions dependencies to full commit SHAs Pin all GitHub Actions dependencies to full commit SHA hashes to prevent supply chain attacks via mutable version tags. Resolves SonarQube security hotspots for dependency pinning. Amp-Thread-ID: https://ampcode.com/threads/T-019c5d70-7c3a-75cf-8125-ad20327fef07 Co-authored-by: Amp --- .github/workflows/claude-pr-review.yml | 4 ++-- .github/workflows/test.yml | 10 +++++----- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/claude-pr-review.yml b/.github/workflows/claude-pr-review.yml index 2ed7830..4069441 100644 --- a/.github/workflows/claude-pr-review.yml +++ b/.github/workflows/claude-pr-review.yml @@ -17,12 +17,12 @@ jobs: pull-requests: write id-token: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: fetch-depth: 1 - name: Run Claude Code Review - uses: anthropics/claude-code-action@v1 + uses: anthropics/claude-code-action@a3ff61d47aa5118a43b33ae44c4087d9eb51111a # v1 with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} github_token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 31fb03b..6000557 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -24,10 +24,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '20' cache: 'npm' @@ -40,19 +40,19 @@ jobs: - name: Upload coverage reports if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: coverage-report path: coverage/ retention-days: 30 - name: SonarQube Scan - uses: SonarSource/sonarqube-scan-action@v7 + uses: SonarSource/sonarqube-scan-action@a31c9398be7ace6bbfaf30c0bd5d415f843d45e9 # v7.0.0 env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} - name: Comment PR with test results if: github.event_name == 'pull_request' && always() - uses: actions/github-script@v7 + uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 with: script: | const fs = require('fs'); From b988ba954fdfa108716cf4216b6c1a5dff080b64 Mon Sep 17 00:00:00 2001 From: rsimpson2 Date: Sat, 14 Feb 2026 13:56:36 -0500 Subject: [PATCH 2/3] fix: disable track_progress for labeled event action Amp-Thread-ID: https://ampcode.com/threads/T-019c5d70-7c3a-75cf-8125-ad20327fef07 Co-authored-by: Amp --- .github/workflows/claude-pr-review.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/claude-pr-review.yml b/.github/workflows/claude-pr-review.yml index 4069441..c1b33ed 100644 --- a/.github/workflows/claude-pr-review.yml +++ b/.github/workflows/claude-pr-review.yml @@ -26,7 +26,7 @@ jobs: with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} github_token: ${{ secrets.GITHUB_TOKEN }} - track_progress: true + track_progress: ${{ github.event.action != 'labeled' }} prompt: | Review this PR as a coding challenge learning exercise. This repository contains solutions from multiple platforms (LeetCode, GreatFrontEnd, etc.). From ef040c965ade84c1e8325b74baf50ec297b6df04 Mon Sep 17 00:00:00 2001 From: rsimpson2 Date: Sat, 14 Feb 2026 13:59:28 -0500 Subject: [PATCH 3/3] fix: add sonar.organization to sonar-project.properties Amp-Thread-ID: https://ampcode.com/threads/T-019c5d70-7c3a-75cf-8125-ad20327fef07 Co-authored-by: Amp --- sonar-project.properties | 1 + 1 file changed, 1 insertion(+) diff --git a/sonar-project.properties b/sonar-project.properties index 854e5b4..3dc9574 100644 --- a/sonar-project.properties +++ b/sonar-project.properties @@ -1,2 +1,3 @@ sonar.projectKey=pertrai1_coding-challenges +sonar.organization=pertrai1 sonar.javascript.lcov.reportPaths=./coverage/lcov.info