From 0f2d92a14982ec968290cefe36c3708113c254c1 Mon Sep 17 00:00:00 2001 From: Noah Schatz Date: Sat, 7 Nov 2026 22:49:21 -0500 Subject: [PATCH] ci: pin the shared workflows by commit SHA --- .github/dependabot.yml | 5 +++++ .github/workflows/codeql.yml | 2 +- .github/workflows/pr-title.yml | 2 +- .github/workflows/scorecard.yml | 2 +- 4 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d8018fa..4393e12 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -44,6 +44,11 @@ updates: # never proposed here. ignore: - dependency-name: "reviewdog/action-actionlint" + # The cosyte/.github reusable workflows are pinned to the commit of a published `workflows-*` + # reference and move by hand, with every caller here, together (ST37). Left to Dependabot, a + # commit pin with no version tag is offered the newest commit on cosyte/.github's main, which is + # not a published reference. + - dependency-name: "cosyte/.github*" commit-message: prefix: chore include: scope diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 3d3214f..c1a8590 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -27,6 +27,6 @@ jobs: security-events: write # upload the SARIF to the Security tab contents: read actions: read - uses: cosyte/.github/.github/workflows/codeql.yml@workflows-2026-11-07-498c7c13c886 + uses: cosyte/.github/.github/workflows/codeql.yml@498c7c13c8869bf11b67fa8324684ec2dc691ec6 # workflows-2026-11-07-498c7c13c886 with: languages: '["actions", "javascript-typescript"]' diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml index 388accc..d8c803f 100644 --- a/.github/workflows/pr-title.yml +++ b/.github/workflows/pr-title.yml @@ -21,4 +21,4 @@ jobs: pr-title: permissions: contents: read - uses: cosyte/.github/.github/workflows/pr-title.yml@workflows-2026-11-07-498c7c13c886 + uses: cosyte/.github/.github/workflows/pr-title.yml@498c7c13c8869bf11b67fa8324684ec2dc691ec6 # workflows-2026-11-07-498c7c13c886 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 62497e5..d17aae6 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -20,4 +20,4 @@ jobs: contents: read # required to resolve the reusable workflow (else contents:none and a startup failure) security-events: write # upload the SARIF to the Security tab id-token: write # publish results to the OpenSSF API (for the badge) - uses: cosyte/.github/.github/workflows/scorecard.yml@workflows-2026-11-07-498c7c13c886 + uses: cosyte/.github/.github/workflows/scorecard.yml@498c7c13c8869bf11b67fa8324684ec2dc691ec6 # workflows-2026-11-07-498c7c13c886