dependabot[bot] and GitHub
6f17a5d8df
Bump actions/checkout from 3.2.0 to 3.3.0
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 3.2.0 to 3.3.0.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/755da8c3cf115ac066823e79a1e1788f8940201b...ac593985615ec2ede58e132d2e21d2b1cbd6127c )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
2023-01-09 05:10:46 +00:00
dependabot[bot] and GitHub
1f72dca0ff
Bump ossf/scorecard-action from 2.1.0 to 2.1.2
...
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action ) from 2.1.0 to 2.1.2.
- [Release notes](https://github.com/ossf/scorecard-action/releases )
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md )
- [Commits](https://github.com/ossf/scorecard-action/compare/937ffa90d79c7d720498178154ad4c7ba1e4ad8c...e38b1902ae4f44df626f11ba0734b14fb91f8f86 )
---
updated-dependencies:
- dependency-name: ossf/scorecard-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2022-12-26 05:08:53 +00:00
W. Felix Handte
150aa23ef4
Pin Remaining Action Dependencies (Except OSS-Fuzz)
...
The one that isn't pinned is the OSS-Fuzz builder and runner. They don't
offer tagged releases. I could pin to the current master commit, but I'm not
sure how desirable that is.
2022-12-20 17:10:01 -05:00
W. Felix Handte
e3f2c8b11c
Pin actions/checkout Dependency to Specific Commit Hash
...
It's a bit silly, because if we can't trust GitHub, what are we doing here?
But OSSF complains about it, so let's fix it.
2022-12-20 14:53:12 -05:00
Felix Handte and GitHub
ea199876e2
Merge pull request #3378 from facebook/dependabot/github_actions/github/codeql-action-2.1.37
...
Bump github/codeql-action from 1.0.26 to 2.1.37
2022-12-20 14:17:33 -05:00
Felix Handte and GitHub
5f0543a508
Merge pull request #3377 from facebook/dependabot/github_actions/ossf/scorecard-action-2.1.0
...
Bump ossf/scorecard-action from 2.0.6 to 2.1.0
2022-12-20 14:16:10 -05:00
dependabot[bot] and GitHub
79a00f8dcf
Bump github/codeql-action from 1.0.26 to 2.1.37
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 1.0.26 to 2.1.37.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/5f532563584d71fdef14ee64d17bafb34f751ce5...959cbb7472c4d4ad70cdfe6f4976053fe48ab394 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2022-12-19 05:07:15 +00:00
dependabot[bot] and GitHub
65545969d5
Bump ossf/scorecard-action from 2.0.6 to 2.1.0
...
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action ) from 2.0.6 to 2.1.0.
- [Release notes](https://github.com/ossf/scorecard-action/releases )
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md )
- [Commits](https://github.com/ossf/scorecard-action/compare/99c53751e09b9529366343771cc321ec74e9bd3d...937ffa90d79c7d720498178154ad4c7ba1e4ad8c )
---
updated-dependencies:
- dependency-name: ossf/scorecard-action
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
2022-12-19 05:07:09 +00:00
dependabot[bot] and GitHub
9730aa4326
Bump actions/upload-artifact from 1 to 3
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 1 to 3.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/v1...v3 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2022-12-08 18:39:58 +00:00
Joyce Brum
a8f8dc8c5c
fix: upgrade scorecard action to 2.0.6
...
Signed-off-by: Joyce Brum <joycebrum@google.com >
2022-11-01 14:55:31 -03:00
W. Felix Handte
de9a450c00
Restrict from Running on Forks
2022-10-03 11:23:29 -04:00
Felix Handte
79729f8a2d
Create scorecards.yml
...
Addresses #3269 .
2022-09-30 14:30:22 -04:00