CI: Hash pin all GH actions + configure dependabot for those. #1417
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>
Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>
It'll generate a single monthly PR with updates on all relevant github actions Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>
Implemented as discussed at prometheus#1294 and already implemented at prometheus/prometheus Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>
Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>
ArthurSens
approved these changes
Jan 3, 2024
Yes it does! =D |
|
I did this for you (: |
bwplotka
changed the title
Gosh, sorry about that hehe, but thanks! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes #1416
As mentioned on the issue, this PR enhances project security by hash-pinning the dependencies that are called under dangerous permissions and configuring dependabot to automatically update them. Additionally, I've also used this PR to contribute with the nit-pick I've mentioned on commentaries at #1294; those changes will ensure all workflows are running with minimal permissions.
I configured dependabot in a way that all of version updates will be collapsed in a single PR sent monthly -- this avoids noisy PRs, which is a common concern haha. Regardless of the frequency chosen, for the case of security updates a PR with the fixed version would be sent right away.