From 7d7477845fc1734eb85c06a313a06cf2bd22ab68 Mon Sep 17 00:00:00 2001 From: generalpawz Date: Sat, 26 Sep 2026 15:14:15 +0000 Subject: [PATCH 1/2] ci: pin actions in .github/workflows/ci.yml to commit SHAs Claude-Session: https://claude.ai/code/session_01V2HyuKe7QWf4WKxHdEJEjD --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 86da392..fb760ae 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,9 +13,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust 1.88 - uses: dtolnay/rust-toolchain@1.88.0 + uses: dtolnay/rust-toolchain@688313b0823df1393bcebb1b4add0438a6d36884 # 1.88.0 with: components: rustfmt, clippy - name: Run verified gate From 3630785f03188d1e32b0fc016568582de6cfda66 Mon Sep 17 00:00:00 2001 From: generalpawz Date: Sat, 26 Sep 2026 15:14:16 +0000 Subject: [PATCH 2/2] ci: keep action pins current with Dependabot Claude-Session: https://claude.ai/code/session_01V2HyuKe7QWf4WKxHdEJEjD --- .github/dependabot.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..be78a9c --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,14 @@ +# Workflows pin every action to a full commit SHA (a moved tag cannot change +# what runs). Dependabot keeps those pins current: it proposes the new SHA and +# rewrites the version comment beside it, one grouped PR a week. +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + groups: + github-actions: + patterns: ["*"] + commit-message: + prefix: ci