mirror of
https://github.com/Chatterino/chatterino2.git
synced 2026-08-24 10:04:53 -05:00
NerixyzandGitHub
bf71244ed0
To prevent issues from using GitHub actions and dependabot, I hardened the workflows using [zizmor](https://docs.zizmor.sh/). There are still 77 open findings. I only applied the ones that are easy wins. - Pin actions to a commit hash instead of tag - tags are not immutable (see [`unpinned-uses`](https://docs.zizmor.sh/audits/#unpinned-uses)) - Disable `persist-credentials` on checkout - we don't need it (see [`artipacked`](https://docs.zizmor.sh/audits/#artipacked)) - Set cooldown on dependabot updates (see [`dependabot-cooldown`](https://docs.zizmor.sh/audits/#dependabot-cooldown)). For our own packages, we can manually create PRs. I left the docker images unpinned, because they're frequently updated, but zizmor would like to see them pinned as well. Reviewed-by: pajlada <rasmus.karlsson@pajlada.com>
20 lines
355 B
YAML
20 lines
355 B
YAML
version: 2
|
|
updates:
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "daily"
|
|
labels:
|
|
- "ci"
|
|
cooldown:
|
|
default-days: 7
|
|
- package-ecosystem: "gitsubmodule"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "daily"
|
|
labels:
|
|
- "ci"
|
|
- "submodules"
|
|
cooldown:
|
|
default-days: 7
|