Martin Vogel
dd30132e2d
- All GitHub Actions pinned to immutable commit SHAs (prevents tag-poisoning attacks like tj-actions/changed-files incident) - Security audit (Layer 1) now blocks unpinned Actions in CI - Dependabot configured to auto-propose SHA updates weekly - Pre-commit hooks tracked in scripts/hooks/ for contributors - Time-bomb detection + MCP file read audit added to Layer 1
7 lines
118 B
YAML
7 lines
118 B
YAML
version: 2
|
|
updates:
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|