From 52de5d8dbd7446747274d3a0036394b1fa2428fa Mon Sep 17 00:00:00 2001 From: Oleg Strutsovski Date: Mon, 13 Jul 2026 15:15:27 -0700 Subject: [PATCH] Fix Semgrep SAST findings: Dependabot cooldown and pinned action - Add cooldown (default-days: 7) to the github-actions Dependabot ecosystem entry so newly published packages wait before being proposed (CWE-829 / A08:2021). - Pin dependabot/fetch-metadata to its full-length commit SHA instead of the mutable @v2 tag to prevent supply-chain tag repointing (CWE-1357/CWE-353 / A08:2021). Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/dependabot.yml | 2 ++ .github/workflows/dependabot-auto-merge.yml | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index ee23870..f2838dd 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -3,6 +3,8 @@ updates: - package-ecosystem: "github-actions" directory: "/" schedule: { interval: "weekly" } + cooldown: + default-days: 7 groups: github-actions: patterns: ["*"] diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index f46562b..8846fe6 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -11,7 +11,7 @@ jobs: if: ${{ github.actor == 'dependabot[bot]' }} runs-on: ubuntu-latest steps: - - uses: dependabot/fetch-metadata@v2 + - uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2 id: meta with: github-token: ${{ secrets.GITHUB_TOKEN }}