SergeyandGitHub
0ba029b015
* chore(release): build once, and publish sha256sums and provenance (epic #701, phase 5) * chore(ci): pin every third-party action by commit sha (epic #701, phase 5) * test(ci): anchor the dependabot guard on the ecosystem it must cover
15 lines
492 B
YAML
15 lines
492 B
YAML
version: 2
|
|
updates:
|
|
# Actions are pinned by commit SHA (tests/test_workflow_action_pins.py), which
|
|
# is only safe if something moves the pins: an action nobody bumps stops
|
|
# receiving its own security fixes, and the pin hides that it has gone stale.
|
|
# Grouped so this arrives as one pull request a week rather than fifteen.
|
|
- package-ecosystem: github-actions
|
|
directory: /
|
|
schedule:
|
|
interval: weekly
|
|
groups:
|
|
github-actions:
|
|
patterns:
|
|
- '*'
|