Skip to content

Pin actions to SHAs, restrict token, add Dependabot - #2

Merged
jackson-asmith merged 1 commit into
mainfrom
harden/actions-supply-chain
Oct 13, 2026
Merged

jackson-asmith merged 1 commit into
mainfrom
harden/actions-supply-chain

Conversation

@jackson-asmith

@jackson-asmith jackson-asmith commented Oct 13, 2026 •

Copy link
Copy Markdown
Owner
  • Pins all actions to full commit SHAs, including the third-party ludeeus/action-shellcheck and bats-core/bats-action (same versions as before).
  • Adds top-level permissions: contents: read to lint.yml and deploy.yml so the GITHUB_TOKEN is read-only regardless of the repo default.
  • Adds Dependabot for GitHub Actions to keep the pins current.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BHZGQ1G82jm25LZL9XjcqM
@jackson-asmith
jackson-asmith merged commit 3b41690 into main Oct 13, 2026
4 checks passed
@jackson-asmith
jackson-asmith deleted the harden/actions-supply-chain branch October 13, 2026 16:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant