Repository navigation
Pin GitHub Actions to full-length commit SHAs and add Dependabot cooldown - #106
Merged
Merged
Conversation
Require explicit user-local or trusted process provider selection, construct closed CLI invocations, and support known Windows npm entry points without shell wrappers. Make Git hooks opt-in and sync-only, retain provider permission checks, and gate releases on isolated security regressions and artifact checks.
Update multilingual onboarding, local provider selection and migration guidance, opt-in sync hooks, Windows npm compatibility, and approval-aware command templates. Correct CLI help and permission messaging without changing control flow; document the separate Release ZIP permission scope.
Validate directory-entry operations without resolving the final symlink while retaining target checks for content writes. Add sandbox boundary and cleanup regressions, and correct Markdown lint errors in the Windows UTF-8 repro guide.
Resolve product tools outside the workspace, pin CLI self-invocation and use trusted assets for initial encoding. Validate all sh/ps release ZIPs and add isolated execution regressions.
Adapt PR #94 to the current workflows, including security regressions and setup-python references. Preserve existing workflow behavior and document the action update policy. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
HYS (HuYaSen)
approved these changes
Oct 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adapt the hardening proposed in #94 to the current workflows: pin remote
GitHub Actions to full-length commit SHAs and configure weekly, grouped
Dependabot updates with a seven-day cooldown.
Why?
Mutable action tags can be retargeted to different commits, creating a
supply-chain risk. Pinning actions to verified commit SHAs improves
reproducibility and prevents tag changes from silently changing the code
executed by our workflows.
The cooldown provides time for newly published releases to receive
community scrutiny before Dependabot proposes version updates.
What changed?
pre-release, and security regression workflows:
and setup-python references added since its base version.
No action major versions are upgraded. Local reusable workflow references,
triggers, permissions, security gates, and release steps remain unchanged.
Validation
against their JSON schemas.
only remote action references changed.
26 Markdown files checked, zero errors.
Remote GitHub Actions workflows have not been run for this commit.
Related
Supersedes the changes proposed in #94, adapted to the current codebase.