From 5dc9372d35daa7d217c232ea368b02ff86c8d516 Mon Sep 17 00:00:00 2001 From: Morgan Helton Date: Fri, 3 Apr 2026 09:27:56 -0500 Subject: [PATCH] chore: pin GitHub Actions to SHA Pin all external action references to immutable commit SHAs to mitigate supply chain attacks. Tracking: https://github.com/flox/product/issues/1302 Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/dependabot.yml | 6 ++++++ .github/workflows/build.yml | 6 ++++-- 2 files changed, 10 insertions(+), 2 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..5ace460 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,6 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 5f365c9..1368a2e 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -9,10 +9,12 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - name: Install flox - uses: flox/install-flox-action@v2 + uses: flox/install-flox-action@c94e7e1ab56ae14fe98bae4fd84384fd135f0c2a # v2 + - name: Build run: flox activate -- make local