From 923b2be340a9f5e97f4ca5d9a247b465f8ea8452 Mon Sep 17 00:00:00 2001 From: Alexandra DeWit Date: Wed, 22 Apr 2026 13:33:37 -0400 Subject: [PATCH 1/4] ci: pin GitHub Actions to commit SHAs Part of Platform Engineering supply chain security hardening. Dependabot will keep these SHAs current automatically. --- .github/dependabot.yml | 9 +++++++++ .github/workflows/build.yml | 2 +- 2 files changed, 10 insertions(+), 1 deletion(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..e8ffec5 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,9 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directories: + - ".github/workflows" + schedule: + interval: "weekly" + cooldown: + default-days: 15 diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 0d3be48..8bffda2 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -10,7 +10,7 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 - name: submodules run: git submodule update --init --recursive - name: cmake From d448da57d6b0a7d5b5b9f26436dd158e49f11786 Mon Sep 17 00:00:00 2001 From: Alexandra DeWit Date: Wed, 22 Apr 2026 14:07:42 -0400 Subject: [PATCH 2/4] ci: add version comments to SHA-pinned actions --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 8bffda2..f64a37a 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -10,7 +10,7 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 - name: submodules run: git submodule update --init --recursive - name: cmake From 3439029bfec75ec1fc37a4fb8e0a45f417bafa53 Mon Sep 17 00:00:00 2001 From: Alexandra DeWit Date: Wed, 22 Apr 2026 15:07:02 -0400 Subject: [PATCH 3/4] ci: add version comments to SHA-pinned actions --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index f64a37a..383c9a6 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -10,7 +10,7 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 #v2 - name: submodules run: git submodule update --init --recursive - name: cmake From c81486150ddfeae49dc5b6b8501d03696ecc8463 Mon Sep 17 00:00:00 2001 From: Alexandra DeWit Date: Wed, 22 Apr 2026 15:41:36 -0400 Subject: [PATCH 4/4] ci(dependabot): add commit-message conventional commit config --- .github/dependabot.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e8ffec5..deb39e9 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -7,3 +7,6 @@ updates: interval: "weekly" cooldown: default-days: 15 + commit-message: + prefix: "build" + include: "scope"