chore(ci): pin attested-delivery/.github reusables to v0.1.0 - #4
Merged
Conversation
Re-pin all .github reusable-workflow and action references (quality-gates, ci, release, catalog-admission) to the v0.1.0 release SHA f211de9, with # v0.1.0 labels — the marketplace now tracks the first tagged release of the central catalog instead of intermediate commits.
There was a problem hiding this comment.
Pull request overview
Re-pins all attested-delivery/.github reusable workflow/action references in this repo’s GitHub Actions pipelines to the first tagged release (v0.1.0) by using the release SHA f211de97395ced798da52e28d89d79c22b3020ee, improving consistency and supply-chain traceability across CI, quality gates, release, and catalog admission workflows.
Changes:
- Updated all referenced
attested-delivery/.githubreusable workflows to@f211de9… # v0.1.0. - Updated the
plugin-catalog-updateaction reference in catalog admission to the samev0.1.0SHA. - Standardized pins that previously pointed at multiple intermediate commits.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| .github/workflows/release.yml | Re-pins release pipeline reusable workflows (gates, attestations, signing, vex) to attested-delivery/.github v0.1.0 SHA. |
| .github/workflows/quality-gates.yml | Re-pins merge-time security/quality gate reusables (SAST/SCA/Trivy/Scorecard + plugin gates) to v0.1.0. |
| .github/workflows/ci.yml | Re-pins pin-check and actionlint reusable workflows to v0.1.0. |
| .github/workflows/catalog-admission.yml | Re-pins plugin-catalog-update action used for fail-closed attestation verification to v0.1.0. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| contents: read | ||
| uses: >- | ||
| attested-delivery/.github/.github/workflows/pin-check.yml@aba1860be6b6ebd5c0c0a0f07160946fb0349965 | ||
| attested-delivery/.github/.github/workflows/pin-check.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 |
| contents: read | ||
| uses: >- | ||
| attested-delivery/.github/.github/workflows/reusable-actionlint.yml@b314c29ac9d445ea1f6ad5487743a909e104ceb9 | ||
| attested-delivery/.github/.github/workflows/reusable-actionlint.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 |
| packages: read | ||
| uses: >- | ||
| attested-delivery/.github/.github/workflows/reusable-sast-codeql.yml@698148e12da113cfeeef8742c31ae93657959e67 | ||
| attested-delivery/.github/.github/workflows/reusable-sast-codeql.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 |
| permissions: { security-events: write, contents: read, actions: read, packages: read } | ||
| uses: >- | ||
| attested-delivery/.github/.github/workflows/reusable-sast-codeql.yml@698148e12da113cfeeef8742c31ae93657959e67 | ||
| attested-delivery/.github/.github/workflows/reusable-sast-codeql.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Re-pin all
attested-delivery/.githubreusable-workflow and action references to the v0.1.0 release SHAf211de97395ced798da52e28d89d79c22b3020ee, with# v0.1.0labels.27 references across
ci.yml,quality-gates.yml,release.yml, andcatalog-admission.ymlpreviously pinned at intermediate commits (698148e,b26631,aba1860,b314c29,b74df46) now all track the first tagged release of the central catalog. actionlint clean;pin-checkenforces the 40-char SHAs.