Skip to content

fix: pin GitHub Actions to full SHA hashes#63

Merged
BKDDFS merged 1 commit intomainfrom
fix/pin-actions-sha
Jan 30, 2026
Merged

fix: pin GitHub Actions to full SHA hashes#63
BKDDFS merged 1 commit intomainfrom
fix/pin-actions-sha

Conversation

@BKDDFS
Copy link
Copy Markdown
Owner

@BKDDFS BKDDFS commented Jan 30, 2026

Summary

  • Pin all GitHub Actions to full commit SHA hashes instead of version tags
  • Resolves SonarCloud warning: "Use full commit SHA hash for this dependency"

Changes

All workflow files updated with SHA + version comment:

  • actions/checkout@v6.0.1
  • actions/setup-python@v6.2.0
  • googleapis/release-please-action@v4.4.0
  • github/codeql-action@v3
  • astral-sh/setup-uv@v7.2.1
  • codecov/codecov-action@v5.5.2
  • pre-commit/action@v3.0.1
  • amannn/action-semantic-pull-request@v6.1.1
  • ossf/scorecard-action@v2.4.3
  • softprops/action-gh-release@v2.5.0
  • anchore/sbom-action@v0.22.1
  • actions/attest-sbom@v3.0.0
  • aquasecurity/trivy-action@0.33.1

@sonarqubecloud
Copy link
Copy Markdown

@BKDDFS BKDDFS merged commit 0d5f898 into main Jan 30, 2026
9 checks passed
This was referenced Jan 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants