Skip to content

fix(ci): harden GitHub Actions workflows (#758) - #760

Merged
paulinebm merged 2 commits into
mainfrom
security/workflow-hardening/pr-758
Oct 6, 2026
Merged

paulinebm merged 2 commits into
mainfrom
security/workflow-hardening/pr-758

Conversation

@hf-security-analysis

@hf-security-analysis hf-security-analysis Bot commented Oct 6, 2026 •

Copy link
Copy Markdown
Contributor

Automated hardening of the workflow files flagged on #758.

Targets main. Files changed, and what changed them:

  • .github/workflows/ci.yml — action pins
  • .github/workflows/docs.yml — action pins

Fixed by this PR:

  • HIGH unpinned-action (pinact) — .github/workflows/ci.yml:65
  • HIGH unpinned-action (pinact) — .github/workflows/docs.yml:30

Pinning changes come from pinact and are mechanical. Any other change was generated by Claude — read it before merging.

Closes huggingface/tracking-issues#1156

@paulinebm
paulinebm merged commit 0c233ff into main Oct 6, 2026
2 checks passed
@paulinebm
paulinebm deleted the security/workflow-hardening/pr-758 branch October 6, 2026 12:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant