copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #260 from copenhagentruckwash/fix-unpinned-github-actions-vulnerability

Browse Source 
Harden Qodana workflow permissions and pin checkout action
This commit is contained in:
Jeppe B
2026-06-02 00:17:44 +02:00
committed by GitHub
parent fbad5f767f 6489706231
commit 434a5049e2
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/code_quality.yml
+2 -1
View File
@@ -16,10 +16,11 @@ jobs:
pull-requests: read pull-requests: read
checks: read checks: read
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with: with:
ref: ${{ github.event.pull_request.head.sha || github.sha }} # Use PR head when available, otherwise the pushed SHA. ref: ${{ github.event.pull_request.head.sha || github.sha }} # Use PR head when available, otherwise the pushed SHA.
fetch-depth: 0 # a full history is required for pull request analysis fetch-depth: 0 # a full history is required for pull request analysis
persist-credentials: false
- name: Mark repository as safe for Git - name: Mark repository as safe for Git
run: git config --global --add safe.directory "$GITHUB_WORKSPACE" run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
- name: Prepare Qodana cache directories - name: Prepare Qodana cache directories