Commit History
29 days ago
-
Pin GitHub Actions to commit SHAs (#8)
hf-security-analysis[bot] +1: hf-security-analysis[bot]Unverified signatureA tag is mutable: whoever controls the action's repository can move `v4` to different code, and the next run picks it up with no diff to review. Pinning to the commit SHA freezes the code that runs today. Co-authored-by: hf-security-analysis[bot] <265538906+hf-security-analysis[bot]@users.noreply.github.com>b70a991 -
Scope GITHUB_TOKEN permissions per job (#7)
hf-security-analysis[bot] +1: hf-security-analysis[bot]Unverified signatureA job with no `permissions:` block inherits whatever the repository hands out. Each block added here grants what that job's own steps need and nothing more. Co-authored-by: hf-security-analysis[bot] <265538906+hf-security-analysis[bot]@users.noreply.github.com>beaf717
-
chore: track GitHub Actions versions with Dependabot
hf-security-analysis[bot]Unverified signature57683bf
-
First build
6426ece
