Merge pull request #260 from copenhagentruckwash/fix-unpinned-github-actions-vulnerability

Harden Qodana workflow permissions and pin checkout action
2026-06-02 00:17:44 +02:00
parent fbad5f767f 6489706231
commit 434a5049e2
1 changed files with 2 additions and 1 deletions
@@ -16,10 +16,11 @@ jobs:
      pull-requests: read
      checks: read
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}  # Use PR head when available, otherwise the pushed SHA.
          fetch-depth: 0  # a full history is required for pull request analysis
+          persist-credentials: false
      - name: Mark repository as safe for Git
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
      - name: Prepare Qodana cache directories