mirror of
https://github.com/ArduPilot/ardupilot.git
synced 2026-10-02 10:23:25 +08:00
Pierre KancirandClaude Opus 5
8e91f661ca
Falling back to the offline audits kept the gate running but not honest: a known-vulnerable action passed because some unrelated reference in the tree could not be resolved, and that is not a blip -- once such a reference is on master every run takes the fallback, with known-vulnerable-actions and ref-confusion quietly off. Measured: a tree with actions/download-artifact@v4.0.0 is exit 14 alone and exit 0 with one unresolvable uses: added. Still run the offline audits for what they can say, but fail the job. --strict-collection so a workflow zizmor cannot parse is an error rather than a skipped file -- an injection inside one passed before, measured -- and --collect=all so .gitignore cannot hide an input from the audit. rc from PIPESTATUS, or a failing tee would mask zizmor's exit code. Drop the claim that an unresolvable action fails the job outright, which is what the fallback exists to handle, and say what the dependabot cooldown does: it delays the bump, it does nothing about a moved tag. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
21 lines
880 B
YAML
21 lines
880 B
YAML
# Keep GitHub Actions up to date with GitHub's Dependabot...
|
|
# https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot
|
|
# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#package-ecosystem
|
|
version: 2
|
|
updates:
|
|
- package-ecosystem: github-actions
|
|
commit-message:
|
|
prefix: .github
|
|
directory: /
|
|
groups:
|
|
github-actions:
|
|
patterns:
|
|
- "*" # Group all Actions updates into a single larger pull request
|
|
schedule:
|
|
interval: weekly
|
|
# wait a week before proposing a new version, so a release pulled shortly
|
|
# after publication is never proposed at all. Note this only delays the
|
|
# bump: a tag moved under an existing pin is not covered by it.
|
|
cooldown:
|
|
default-days: 7
|