From cb8303967e79490f4a35c06db47afd23a57ced3d Mon Sep 17 00:00:00 2001 From: Kellen Murphy Date: Sun, 7 Jun 2026 16:09:46 -0400 Subject: [PATCH] ci: note why SHA-pin enforcement is off at the OSV pin The "Require actions pinned to a full-length commit SHA" repo setting is disabled because osv-scanner-action v2.3.8's reusable workflow ships an unpinned actions/download-artifact, which GitHub enforces recursively and fails this job at startup. Fixed upstream on main (f6fb127), unreleased. Re-enable once Dependabot bumps this pin past the next release. ci-only change (release-please no-op). --- .github/workflows/ci.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 976aa48..dd5e60e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -80,6 +80,12 @@ jobs: osv-scanner: name: OSV Scanner # google/osv-scanner-action v2.3.8 + # NOTE: the repo setting "Require actions pinned to a full-length commit SHA" + # is intentionally OFF. v2.3.8's reusable workflow ships an unpinned + # actions/download-artifact, which GitHub's SHA-pin enforcement rejects + # recursively (breaks this job at startup). Fixed upstream on main + # (osv-scanner-action commit f6fb127, not yet in a release). Re-enable the + # setting once Dependabot bumps this pin past the next osv-scanner-action release. uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@9a498708959aeaef5ef730655706c5a1df1edbc2 with: scan-args: |-