Skip to content

Pin GitHub Actions dependencies#254

Merged
lancewillett merged 1 commit into
masterfrom
fix/pin-github-actions-node24
May 30, 2026
Merged

Pin GitHub Actions dependencies#254
lancewillett merged 1 commit into
masterfrom
fix/pin-github-actions-node24

Conversation

@lancewillett

Copy link
Copy Markdown
Contributor

Summary

  • Upgrade actions/checkout and actions/setup-node to their Node 24 v5 releases.
  • Pin both actions to full commit SHAs instead of mutable tags.
  • Restrict workflow token permissions to contents: read.

Pinned versions:

  • actions/checkout@v5 => 93cb6efe18208431cddfb8368fd83d5badbf9bfd
  • actions/setup-node@v5 => a0853c24544627f65ddf259abe73b1d18a591444

Testing

  • ruby -e 'require "yaml"; YAML.load_file(".github/workflows/ci.yml"); puts "workflow yaml ok"'
  • git diff --check

@lancewillett
lancewillett merged commit 11cabc7 into master May 30, 2026
1 check passed
@lancewillett
lancewillett deleted the fix/pin-github-actions-node24 branch May 30, 2026 22:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant