Skip to content

v1.9.2

Choose a tag to compare

View all tags
@bogdaniel bogdaniel released this 27 Jun 08:58
· 551 commits to master since this release
v1.9.2
4c76fad
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Patch: audit-github-actions-pins.sh now matches uses:/image:/container: only as YAML keys, not substrings — fixes a false positive on run: shell blocks that mention those words (e.g. a grep pattern), which failed the unsafe_github_actions gate on projects with no actual unpinned ref. Adds a regression test to self-test.sh. (PR #2)

Assets 2
Loading