From b07199e15eac6f7b497d0ee17015a04c658f6fa3 Mon Sep 17 00:00:00 2001 From: Rob Bos Date: Wed, 1 Jul 2026 21:23:24 +0200 Subject: [PATCH] fix: pin secure-action-inputs to v1.0.0 SHA instead of floating @main Now that secure-action-inputs has a tagged v1.0.0 release, pin the reusable workflow's action reference by commit SHA (with version comment) so Dependabot can track and bump it, matching the pattern already used for step-security/harden-runner in this same file. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/secure-inputs.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/secure-inputs.yml b/.github/workflows/secure-inputs.yml index 16c1550..eff163b 100644 --- a/.github/workflows/secure-inputs.yml +++ b/.github/workflows/secure-inputs.yml @@ -39,5 +39,4 @@ jobs: # - Variation Selectors Supplement (U+E0100-E01EF) — Glassworm attack vector # - BiDi overrides (Trojan Source), shell injection, template injection # - Prompt injection patterns targeting AI agents in CI/CD pipelines - # Pin to a specific SHA after the next release of secure-action-inputs. - uses: devops-actions/secure-action-inputs@main + uses: devops-actions/secure-action-inputs@e99fc0a00a1170cdab03c4a84b00e8c973ad28db # v1.0.0