Commit Graph

5 Commits (efe7a95f412c5598cb4e44467849e46627f86cad)

Author SHA1 Message Date
Gabriela Gutierrez 404301103d
Ref actions by commit SHA in shellcheck.yml
It's important to make sure the SHA's are from the original repositories and not forks.

For reference:

https://github.com/actions/checkout/releases/tag/v3.5.2
8e5e7e5ab8

https://github.com/ludeeus/action-shellcheck/releases/tag/2.0.0
00cae500b0


Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
2 years ago
nathannaveen 3a2c8dd4f8 chore: Set permissions for GitHub actions
Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much.

- Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions

https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions

https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs

[Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)

Signed-off-by: nathannaveen <42319948+nathannaveen@users.noreply.github.com>
3 years ago
dependabot[bot] aa9aca7d12
Bump actions/checkout from 2 to 3
Bumps [actions/checkout](https://github.com/actions/checkout) from 2 to 3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v2...v3)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
3 years ago
shirou 92aa11e80a use ludeeus/action-shellcheck for shellcheck. 4 years ago
Lomanic b0b7969cbf [ci] Implement automatic shellcheck test on GH Actions 4 years ago