Repository navigation
ci: pin actions to SHAs, add Dependabot and actionlint, update to TypeScript 7 - #12
Merged
Merged
Conversation
- Pin every third-party action to a full commit SHA with a version comment. The release job holds an OIDC token for npm, PyPI and crates.io, so a moved tag must not be able to change the code that runs there. - Add a Dependabot config for GitHub Actions, npm and Cargo, so the pins and dependencies stay current. - Run actionlint in CI. It is installed through mise. - Update to TypeScript 7 and @types/node 26. TypeScript 7 no longer loads every @types package by default, so tsconfig lists "node" in "types". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Install actionlint only in the CI check job, through the aqua backend. The mise short name is deprecated, and the release and native-binary jobs do not need the tool. - Fail CI when a third-party action is not pinned to a commit SHA. - Do not persist the write-scoped token in the release job checkout. - Add a 7-day Dependabot cooldown, and keep major action updates out of the grouped PR. - Document the workflow checks in AGENTS.md. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up hardening from the repo review.
.github/dependabot.ymlfor GitHub Actions (grouped), npm (dev minor/patch grouped) and Cargo, weekly. It keeps the SHA pins and dependencies current. Dependabot alerts, security updates, secret scanning and push protection are now enabled in the repo settings..mise.toml).@types/node26. TypeScript 7 no longer loads every@typespackage by default, sotsconfig.jsonnow sets"types": ["node"].Testing
npm run checkpasses locally (Biome, TS build and tests, Rust fmt/clippy/tests, generated files, Python tests).actionlintpasses locally with shellcheck.npm pack --dry-runstill includesdist/*.jsanddist/*.d.ts.🤖 Generated with Claude Code