Skip to content

chore: pin commit SHAs in usage examples, remove floating tag alias workflow#9

Merged
ahmadnassri merged 4 commits intomainfrom
lelia/pin-commit-shas
Mar 27, 2026
Merged

chore: pin commit SHAs in usage examples, remove floating tag alias workflow#9
ahmadnassri merged 4 commits intomainfrom
lelia/pin-commit-shas

Conversation

@lelia
Copy link
Copy Markdown
Contributor

@lelia lelia commented Mar 25, 2026

Summary

This PR tightens our GitHub Action pinning guidance and release posture.

Changes

  • pins all referenced GitHub Actions to commit SHAs in README usage examples
  • adds note on why we recommend pinning to commit SHAs, with immutable version tags as fallback
  • expands the README examples for both free and enterprise to show:
    • commit SHA pinning (most secure)
    • immutable version tag pinning
    • basic Dependabot config
    • optional Dependabot cooldown settings
  • adds # vX.Y.Z comments to pinned third-party action SHAs in GitHub workflows
  • removes the workflow that maintained floating tag aliases like v1 and v1.3

lelia added 4 commits March 25, 2026 17:27
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
…SHAs

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
@lelia lelia requested a review from ahmadnassri March 25, 2026 21:53
@ahmadnassri ahmadnassri merged commit ba6de6c into main Mar 27, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants