action-allowlist-review: bump DavidAnson/markdownlint-cli2-action from 23.0.0 to 23.1.0 in /.github/actions/for-dependabot-triggered-reviews

[dependabot]

Bumps DavidAnson/markdownlint-cli2-action from 23.0.0 to 23.1.0.

Commits

• 6b51ade Update to version 23.1.0.
• ea6e0da Freshen generated index.js file.
• 3c4c2c8 Bump markdownlint-cli2 from 0.22.0 to 0.22.1
• 3a933d4 Bump @​actions/core from 3.0.0 to 3.0.1
• 648042e Freshen generated index.js file.
• d1cf982 Bump eslint from 10.2.0 to 10.2.1
• 4db3dfc Bump eslint from 10.1.0 to 10.2.0
• 70dbff9 Bump eslint-plugin-unicorn from 63.0.0 to 64.0.0
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[potiuk]

Heads-up before approval: the upstream repo DavidAnson/markdownlint-cli2-action doesn't ship a lock file (no package-lock.json / npm-shrinkwrap.json).

The action is bundled (dist/index.mjs), so the runtime artifact is whatever was produced by ncc build at release time. Without a lock file, the dependency closure used to generate dist/ isn't pinned — that makes the bundled artifact non-reproducible and harder to audit for supply-chain changes between versions.

I've opened an upstream request asking the author to commit a lock file: DavidAnson/markdownlint-cli2-action#362

@dfoulks1 @ppkarwasz — what's your take? Do we approve this bump now and treat the upstream lockfile request as a follow-up, or hold approval until the upstream ships a lock file? I lean toward approving (the action is widely used and bundled with a pinned SHA, so the immediate risk is bounded), but happy to wait if either of you would rather block on it.

[ppkarwasz]

I would bump this now and enforce additional checks in the next releases as we learn more about the release process.

This action is much safer than other actions we already allow, since it pins its main dependency (markdownlint-cli2) and doesn't rely on any “download latest release of X” behavior.

[potiuk]

I would bump this now and enforce additional checks in the next releases as we learn more about the release process.

This action is much safer than other actions we already allow, since it pins its main dependency (markdownlint-cli2) and doesn't rely on any “download latest release of X” behavior.

Seems that the author is about to release new version after I poked him (and you followed up @ppkarwasz ! ) ... So.. .I guess we can wait :)

[dependabot]

Superseded by #811.