forked from theupdateframework/python-tuf
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
workflows: Stop pinning actions that are not security relevant
These workflows have no real security relevance (runtime build or test) in the sense that a compromise in the dependencies could compromise python-tuf security: * scorecards * dependency-review * codeql-analysis Stop pinning the actions used in them (except the common actions that are used everyewhere like actions/checkout: use the same version of those everywhere). The benefit here is fewer Dependabot PRs: If we had done this from the start we'd have skipped ~70 PRs by now. The interesting permissions used in these workflows are * security-events: write This can add things onto the "Security" tab in GitHub * id-token: write This allows OIDC authentication, but only as this specific workflow These permissions look completely acceptable to me. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
- Loading branch information
Showing
3 changed files
with
10 additions
and
7 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters