From 16b982a0a45922c4187d76c03e07e7e87406adfb Mon Sep 17 00:00:00 2001 From: Calin Teodor Date: Wed, 14 Oct 2026 12:51:18 -0700 Subject: [PATCH 1/2] ci: pin third-party actions in ci.yml to commit SHAs Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fd72e10..db57556 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -35,7 +35,7 @@ jobs: run: go test -race -coverprofile=coverage.out -covermode=atomic ./... - name: Upload coverage to Codecov - uses: codecov/codecov-action@v7 + uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7 with: files: ./trustedagents/coverage.out flags: unittests From 2f6ed696787be0ba95fd44046b93fe62765f3dd5 Mon Sep 17 00:00:00 2001 From: Calin Teodor Date: Wed, 14 Oct 2026 12:51:20 -0700 Subject: [PATCH 2/2] ci: pin third-party actions in security.yml to commit SHAs Co-Authored-By: Claude Opus 5.5 --- .github/workflows/security.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index a1cdc56..4007ab1 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -73,7 +73,7 @@ jobs: go-version-file: go.mod cache: true - name: Run gosec - uses: securego/gosec@master + uses: securego/gosec@71577268350e1e0f2f1491de1ef53f1227b43c1f # master with: # SARIF for the Security tab; fail the job on any finding. # No rules are globally disabled — the package currently has