From 66dc34ab851bb862697b86354e920aac90898b3f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Ricks?= Date: Mon, 10 Aug 2026 14:51:11 +0200 Subject: [PATCH] CI: Update dependabot config and pin actions to commits Only update greenbone actions for major updates because we trust these tags and don't want to get PRs for each bugfix or minor releases. Also group updates for github's native actions in one PR to allow for less required reviews. Pin actions to commits for improved security. Git tags can be overridden easily. Hashes not. --- .github/dependabot.yml | 9 +++++++++ .github/workflows/codeql.yml | 4 ++-- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 9c353d76..a2880016 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -12,5 +12,14 @@ updates: directory: "/" schedule: interval: "weekly" + groups: + github-actions: + patterns: + - "actions/*" + ignore: + - dependency-name: "greenbone/actions" + update-types: + - "version-update:semver-minor" + - "version-update:semver-patch" commit-message: prefix: "Deps" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 81b145ed..9b4d2788 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,10 +32,10 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 with: languages: ${{ matrix.language }} queries: security-and-quality - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6