github-mirror/libarchive
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8,131 Commits 6 Branches 59 Tags
master
Commit Graph
3 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Pedro Kaj Kjellerup Nacht 935cb3c610 Add Scorecard GHA (#1973) 
Fixes #1972

This adds the Scorecard GitHub Action to monitor the project's
supply-chain security posture.

Signed-off-by: Pedro Kaj Kjellerup Nacht <pnacht@google.com>
 2023-09-17 10:27:16 +02:00
Pedro Nacht 367c854002 Hash-pin GitHub Actions, keep them updated with dependabot (#1960) 
Fixes #1959.

This PR hash-pins GitHub Actions used in workflows and sets up
dependabot to keep the Actions up-to-date.

I've configured dependabot to group all Actions together. So if it ever
discovers that multiple Actions have new versions, it'll only send a
single PR to bump them all together.

---------

Signed-off-by: Pedro Kaj Kjellerup Nacht <pnacht@google.com>
 2023-09-11 22:02:18 +02:00
Pedro Nacht a28aa1b6a4 Set read-only workflow tokens (#1958) 
Fixes #1957.

This PR ensures all workflows run with minimal permissions, instead of
with `write-all` permissions. This will protect the project from
supply-chain attacks.

The change to codeql.yml is for consistency and future-proofing. Should
another job eventually be added to the workflow, it will run with just
`contents: read`.

Signed-off-by: Pedro Kaj Kjellerup Nacht <pnacht@google.com>
 2023-09-04 11:21:27 -07:00