Repository navigation
chore(deps): pin dependencies - #10
Conversation
fleet reviewreviewer: PASSPR #10 is a mechanical, Renovate-authored "pin dependencies" change: it replaces mutable tag refs (@v7, @v6, @V3, and a Renovate-action version tag) with full-length commit SHAs (keeping the human-readable version as a trailing comment) across .github/workflows/ci.yml, renovate.yml, and security.yml. This is the standard GitHub Actions supply-chain hardening practice (prevents a tag being re-pointed to malicious code after review — the class of attack behind the 2025 tj-actions/changed-files compromise). Scope is tight: only the three workflow files, only the action uses: lines; no application code, manifests, or secrets touched. Env is "repo" (no runtime/deploy impact; nothing for ArgoCD to sync). All PR checks are green (CodeQL, build, codeql, secrets, plus the informational renovate/stability-days check), which is itself evidence the pinned SHAs resolve correctly — a bad digest would fail the job at the checkout/setup-java/codeql-action step, and these jobs ran and passed using the new pins. attempted
adversary: PASSThis is a Renovate PR that changes only workflow files. It pins every third-party action in ci.yml and security.yml to a full commit SHA with a version comment (checkout v7, setup-java v6, codeql init/analyze v3, gitleaks v3). It also moves the already-pinned renovatebot/github-action from v46.2.2 to v46.3.9. I could not break it. Every
attempted
security: PASSPR #10 is a Renovate supply-chain hardening change. It touches only 3 workflow files (9 lines changed each way). It replaces mutable major-tag refs (actions/checkout@v7, setup-java@v6, codeql-action init/analyze@v3, gitleaks-action@v3) with full 40-char commit SHAs that keep a version comment. It also bumps renovatebot/github-action from v46.2.2 to v46.3.9, which was already SHA-pinned. No
proofattempted
Approvals: 3/3 on 🤖 Generated with Claude Code |
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
3d3c42eb843ebf4bfa242e0c47f4v46.2.2→v46.3.9v46.3.10Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
renovatebot/github-action
v46.3.9Compare Source
Documentation
Miscellaneous Chores
Build System
Continuous Integration
v46.3.8Compare Source
Documentation
Miscellaneous Chores
Build System
Continuous Integration
v46.3.7Compare Source
Documentation
Miscellaneous Chores
Build System
Continuous Integration
v46.3.6Compare Source
Bug Fixes
Documentation
Miscellaneous Chores
Continuous Integration
v46.3.5Compare Source
Documentation
Miscellaneous Chores
Build System
Continuous Integration
v46.3.4Compare Source
Bug Fixes
renovate-imageto take a full digest-pinned image (#1082) (16deced)Miscellaneous Chores
Continuous Integration
v46.3.3Compare Source
Bug Fixes
Continuous Integration
v46.3.2Compare Source
Documentation
Miscellaneous Chores
Build System
Continuous Integration
v46.3.1Compare Source
Documentation
Miscellaneous Chores
Build System
Continuous Integration
v46.3.0Compare Source
Features
Documentation
Miscellaneous Chores
Continuous Integration
v46.2.6Compare Source
Documentation
Miscellaneous Chores
Build System
Continuous Integration
v46.2.5Compare Source
Documentation
Miscellaneous Chores
Build System
Continuous Integration
v46.2.4Compare Source
Documentation
Build System
v46.2.3Compare Source
Documentation
Miscellaneous Chores
Configuration
📅 Schedule: (in timezone Europe/Zurich)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.