Skip to content

chore/pin actions - #41

Merged
foscomputerservices merged 2 commits into
mainfrom
chore/pin-actions
Nov 2, 2026
Merged

foscomputerservices merged 2 commits into
mainfrom
chore/pin-actions

Conversation

@foscomputerservices

Copy link
Copy Markdown
Owner
  • ci: pin GitHub Actions to commit SHAs and enable Dependabot for actions
  • build: update Package.resolved past the swift-nio-http2 advisories

Floating tags (@v4, @v2) let a compromised upstream run arbitrary code in CI.
Each action is now pinned to the full commit SHA of its current release, with
the version noted in a comment. Dependabot keeps the pins current weekly.
Moves swift-nio-http2 1.29.0 -> 1.46.0 (request smuggling and MadeYouReset
fixes) along with the rest of the NIO and Vapor stack. Builds clean locally.
@foscomputerservices
foscomputerservices merged commit 7a6c122 into main Nov 2, 2026
5 checks passed
@foscomputerservices
foscomputerservices deleted the chore/pin-actions branch November 2, 2026 14:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant