From 5570313421a27bd8a7a7e04de975e64769df8cf8 Mon Sep 17 00:00:00 2001 From: Evgeny Vereshchagin Date: Thu, 11 Nov 2021 01:56:02 +0000 Subject: ci: pin labeler Turns out GHActions where `pull_request_target` is used are capable of pwning repositories: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ labeler doesn't check out the source code or build anything so it's safe in its current form but to avoid surprises let's just pin it to the latest version. It's annoying to manage dependencies like this manually so additionally dependabot.yml is introduced to make it easier to keep GHActions up to date more or less automatically: https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/keeping-your-actions-up-to-date-with-dependabot --- .github/dependabot.yml | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 .github/dependabot.yml (limited to '.github/dependabot.yml') diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000000..123014908b --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,6 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "daily" -- cgit v1.2.1