Skip to content

ci: pin dependencies#579

Merged
UlisesGascon merged 1 commit intoyeoman:mainfrom
step-security-bot:stepsecurity_remediation_1738923345
Feb 7, 2025
Merged

ci: pin dependencies#579
UlisesGascon merged 1 commit intoyeoman:mainfrom
step-security-bot:stepsecurity_remediation_1738923345

Conversation

@step-security-bot
Copy link
Copy Markdown
Contributor

Summary

This pull request is created by StepSecurity at the request of @UlisesGascon. Please merge the Pull Request to incorporate the requested changes. Please tag @UlisesGascon on your message if you have any questions related to the PR.

Security Fixes

Pinned Dependencies

GitHub Action tags and Docker tags are mutable. This poses a security risk. GitHub's Security Hardening guide recommends pinning actions to full length commit.

Feedback

For bug reports, feature requests, and general feedback; please email support@stepsecurity.io. To create such PRs, please visit https://app.stepsecurity.io/securerepo.

Signed-off-by: StepSecurity Bot bot@stepsecurity.io

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
@UlisesGascon UlisesGascon changed the title [StepSecurity] ci: Harden GitHub Actions ci: pin dependencies Feb 7, 2025
@UlisesGascon
Copy link
Copy Markdown
Member

CI errors are not related to this change.

@UlisesGascon UlisesGascon self-assigned this Feb 7, 2025
@UlisesGascon UlisesGascon merged commit 14ad96a into yeoman:main Feb 7, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants