Naveen
0a96b7f0ae
chore: Set permissions for GitHub actions ( #17535 )
...
Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much.
- Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
[Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ )
Signed-off-by: naveen <172697+naveensrinivasan@users.noreply.github.com>
2022-05-03 10:54:51 -06:00
YOSHIDA Katsuhiko
89fcd84f9f
Replace git.io URL ( #17501 )
2022-04-28 07:34:33 -06:00
dependabot[bot]
b0f1452666
Bump github/codeql-action from 1 to 2 ( #17421 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 1 to 2.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/v1...v2 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-04-25 13:29:57 -06:00
dependabot[bot]
01c6445a11
Bump actions/checkout from 2 to 3 ( #16739 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 2 to 3.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/v2...v3 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-03-02 09:51:43 -05:00
Josh Puetz
9fe7be190b
Switch references to Forem master branch to main ( #12325 )
2021-04-16 11:51:06 -05:00
Mac Siri
df245e7e84
Create codeql-analysis.yml ( #10276 )
2020-09-11 09:46:45 +02:00
Mac Siri
7ceb5550a2
Remove codeql-analysis.yml ( #9354 )
2020-07-16 12:15:38 -04:00
Molly Struve
e2d58f862c
[deploy] Remove codeql analysis for right now ( #9308 )
2020-07-14 12:37:45 -05:00
rhymes
b42a843b78
Add Github CodeQL code scanner for JavaScript ( #9217 )
...
GitHub released a code analysis engine that scans the code for potential issues called CodeQL.
Among the list of supported languages we only use JavaScript
2020-07-09 14:16:48 -04:00
