Skip to content

chore: supply chain hardening#4

Merged
featurecreep-cron merged 2 commits intomainfrom
chore/supply-chain-hardening
Mar 29, 2026
Merged

chore: supply chain hardening#4
featurecreep-cron merged 2 commits intomainfrom
chore/supply-chain-hardening

Conversation

@featurecreep-cron
Copy link
Copy Markdown
Owner

Summary

  • Pin all GitHub Actions to commit SHAs (prevents tag-swap attacks)
  • Add dependabot cooldowns (major: 30d, minor: 7d, patch: 3d)
  • Change pip dependabot interval from weekly to daily

Changes

  • .github/workflows/ci.yml — SHA-pin checkout, setup-python, codecov
  • .github/workflows/publish.yml — SHA-pin checkout, setup-python, pypi-publish
  • .github/workflows/codeql.yml — SHA-pin checkout, all codeql-action steps
  • .github/workflows/scorecard.yml — SHA-pin checkout, scorecard-action, codeql upload-sarif
  • .github/dependabot.yml — Add cooldowns, change pip to daily

Test plan

  • CI passes with SHA-pinned actions
  • OpenSSF Scorecard Pinned-Dependencies check improves after merge

@codecov
Copy link
Copy Markdown

codecov bot commented Mar 26, 2026

Codecov Report

❌ Patch coverage is 62.50000% with 6 lines in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
tests/test_architecture.py 62.50% 6 Missing ⚠️

📢 Thoughts on this report? Let us know!

@featurecreep-cron featurecreep-cron merged commit 2468dcf into main Mar 29, 2026
7 of 8 checks passed
@featurecreep-cron featurecreep-cron deleted the chore/supply-chain-hardening branch March 29, 2026 16:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant