Skip to content

Commit 669f85b

Browse files
nullvariantclaude
nullvariant
and
claude
authored
fix(ci): pin GitHub Actions to SHA hashes for Scorecard (#58)
* fix(ci): pin GitHub Actions to SHA hashes for Scorecard Pin all actions in bot workflows to SHA hashes: - actions/checkout@v4 - peter-evans/create-pull-request@v7 - tibdex/github-app-token@v2 This improves the Pinned-Dependencies score in OpenSSF Scorecard. 🖥️ IDE: [Cursor](https://cursor.sh) 🔌 Extension: [Claude Code](https://claude.ai/download) Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Model-Raw: claude-opus-4-5-20251101 * docs: add OpenSSF Best Practices badge to all READMEs Added OpenSSF Best Practices passing badge (project #11709) to: - Repository root README - Git ID Switcher main README - All 26 i18n README files 🖥️ IDE: [Cursor](https://cursor.sh) 🔌 Extension: [Claude Code](https://claude.ai/download) Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Model-Raw: claude-opus-4-5-20251101 * chore: bump version to 0.10.36 with CHANGELOG updates - Add CHANGELOG entries for v0.10.35 and v0.10.36 - Bump version from 0.10.35 to 0.10.36 🖥️ IDE: [Cursor](https://cursor.sh) 🔌 Extension: [Claude Code](https://claude.ai/download) Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Model-Raw: claude-opus-4-5-20251101 --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
1 parent 6573ab6 commit 669f85b

36 files changed

Lines changed: 103 additions & 19 deletions

‎.github/workflows/blaze-bot.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,13 +26,13 @@ jobs:
2626
2727
- name: 🔑 Get App Token
2828
id: app-token
29-
uses: tibdex/github-app-token@v2
29+
uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2
3030
with:
3131
app_id: ${{ secrets.BLAZE_BOT_APP_ID }}
3232
private_key: ${{ secrets.BLAZE_BOT_PRIVATE_KEY }}
3333

3434
- name: 📥 Checkout (FAST!)
35-
uses: actions/checkout@v4
35+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
3636
with:
3737
token: ${{ steps.app-token.outputs.token }}
3838

@@ -56,7 +56,7 @@ jobs:
5656
EOF
5757
5858
- name: 📬 Create PR with verified commit
59-
uses: peter-evans/create-pull-request@v7
59+
uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7
6060
with:
6161
token: ${{ steps.app-token.outputs.token }}
6262
sign-commits: true

‎.github/workflows/ciel-bot.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,13 +26,13 @@ jobs:
2626
2727
- name: 🔑 Get App Token
2828
id: app-token
29-
uses: tibdex/github-app-token@v2
29+
uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2
3030
with:
3131
app_id: ${{ secrets.CIEL_BOT_APP_ID }}
3232
private_key: ${{ secrets.CIEL_BOT_PRIVATE_KEY }}
3333

3434
- name: 📥 Checkout (gently)
35-
uses: actions/checkout@v4
35+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
3636
with:
3737
token: ${{ steps.app-token.outputs.token }}
3838

@@ -56,7 +56,7 @@ jobs:
5656
EOF
5757
5858
- name: 📬 Create PR with verified commit
59-
uses: peter-evans/create-pull-request@v7
59+
uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7
6060
with:
6161
token: ${{ steps.app-token.outputs.token }}
6262
sign-commits: true

‎.github/workflows/justice-bot.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,13 @@ jobs:
2727
2828
- name: 🔑 Get App Token
2929
id: app-token
30-
uses: tibdex/github-app-token@v2
30+
uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2
3131
with:
3232
app_id: ${{ secrets.JUSTICE_BOT_APP_ID }}
3333
private_key: ${{ secrets.JUSTICE_BOT_PRIVATE_KEY }}
3434

3535
- name: 📥 Checkout (for inspection)
36-
uses: actions/checkout@v4
36+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
3737
with:
3838
token: ${{ steps.app-token.outputs.token }}
3939

@@ -63,7 +63,7 @@ jobs:
6363
EOF
6464
6565
- name: 📬 Create PR with verified commit
66-
uses: peter-evans/create-pull-request@v7
66+
uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7
6767
with:
6868
token: ${{ steps.app-token.outputs.token }}
6969
sign-commits: true

‎.github/workflows/luna-bot.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,13 @@ jobs:
2727
2828
- name: 🔑 Get App Token
2929
id: app-token
30-
uses: tibdex/github-app-token@v2
30+
uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2
3131
with:
3232
app_id: ${{ secrets.LUNA_BOT_APP_ID }}
3333
private_key: ${{ secrets.LUNA_BOT_PRIVATE_KEY }}
3434

3535
- name: 📥 Checkout (excitedly)
36-
uses: actions/checkout@v4
36+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
3737
with:
3838
token: ${{ steps.app-token.outputs.token }}
3939

@@ -61,7 +61,7 @@ jobs:
6161
EOF
6262
6363
- name: 📬 Create PR with verified commit
64-
uses: peter-evans/create-pull-request@v7
64+
uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7
6565
with:
6666
token: ${{ steps.app-token.outputs.token }}
6767
sign-commits: true

‎.github/workflows/mimi-bot.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,13 @@ jobs:
2727
2828
- name: 🔑 Get App Token
2929
id: app-token
30-
uses: tibdex/github-app-token@v2
30+
uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2
3131
with:
3232
app_id: ${{ secrets.MIMI_BOT_APP_ID }}
3333
private_key: ${{ secrets.MIMI_BOT_PRIVATE_KEY }}
3434

3535
- name: 📥 Checkout (quietly)
36-
uses: actions/checkout@v4
36+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
3737
with:
3838
token: ${{ steps.app-token.outputs.token }}
3939

@@ -61,7 +61,7 @@ jobs:
6161
EOF
6262
6363
- name: 📬 Create PR with verified commit
64-
uses: peter-evans/create-pull-request@v7
64+
uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7
6565
with:
6666
token: ${{ steps.app-token.outputs.token }}
6767
sign-commits: true

‎.github/workflows/slow-bot.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,13 @@ jobs:
2727
2828
- name: 🔑 Get App Token
2929
id: app-token
30-
uses: tibdex/github-app-token@v2
30+
uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2
3131
with:
3232
app_id: ${{ secrets.SLOW_BOT_APP_ID }}
3333
private_key: ${{ secrets.SLOW_BOT_PRIVATE_KEY }}
3434

3535
- name: 📥 Checkout (reluctantly)
36-
uses: actions/checkout@v4
36+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
3737
with:
3838
token: ${{ steps.app-token.outputs.token }}
3939

@@ -58,7 +58,7 @@ jobs:
5858
EOF
5959
6060
- name: 📬 Create PR with verified commit
61-
uses: peter-evans/create-pull-request@v7
61+
uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7
6262
with:
6363
token: ${{ steps.app-token.outputs.token }}
6464
sign-commits: true

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
# nullvariant-vscode-extensions
22

33
[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/nullvariant/nullvariant-vscode-extensions/badge)](https://securityscorecards.dev/viewer/?uri=github.com/nullvariant/nullvariant-vscode-extensions)
4+
[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/11709/badge)](https://www.bestpractices.dev/projects/11709)
45

56
VS Code extensions by [Null;Variant](https://github.com/nullvariant).
67

‎extensions/git-id-switcher/CHANGELOG.md‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,62 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77

88
## [Unreleased]
99

10+
## [0.10.36] - 2026-01-08
11+
12+
### Added
13+
14+
- **OpenSSF Best Practices Badge**
15+
- Added OpenSSF Best Practices passing badge to all READMEs (28 files)
16+
- Project registered at bestpractices.dev (project #11709)
17+
18+
### Changed
19+
20+
- **CI/CD: Pin GitHub Actions to SHA hashes**
21+
- All actions in bot workflows now pinned to SHA for improved Scorecard Pinned-Dependencies score
22+
- Added explicit permissions to bot workflows for OpenSSF Scorecard compliance
23+
24+
### Security
25+
26+
- **Mend Bolt Integration**
27+
- Configured Mend Bolt for automated security scanning
28+
- Updated `minimist` to v1.2.6 (security fix)
29+
30+
## [0.10.35] - 2026-01-07
31+
32+
### Added
33+
34+
- **OpenSSF Scorecard Integration**
35+
- Added OpenSSF Scorecard GitHub Action for automated security scoring
36+
- Added OpenSSF Scorecard badge to READMEs
37+
- Configured branch protection score improvements
38+
39+
- **SLSA Provenance Attestation**
40+
- Added SLSA Provenance attestation for releases
41+
- Enhances supply chain security with verifiable build provenance
42+
43+
- **Root README Auto-Generation**
44+
- Added script to auto-generate root README.md from `docs/i18n/en/README.md`
45+
- Transforms relative URLs to absolute URLs for external platforms
46+
- GitHub Actions workflow for automatic regeneration on push/PR
47+
48+
### Changed
49+
50+
- **CI/CD: Pin Wrangler Version**
51+
- Pinned wrangler version for improved Pinned-Dependencies score
52+
53+
- **Dependency Updates**
54+
- Updated `actions/checkout` from 4.2.2 to 6.0.1
55+
- Updated `actions/setup-node` from 4.3.0 to 6.1.0
56+
- Updated `actions/upload-artifact` from 4.6.0 to 6.0.0
57+
- Updated `softprops/action-gh-release` from 2.2.1 to 2.5.0
58+
- Updated `github/codeql-action` to latest
59+
- Added GitHub Actions dependency grouping for Renovate
60+
61+
### Fixed
62+
63+
- **CI/CD: R2 Paths**
64+
- Updated R2 paths in publish.yml to monorepo structure
65+
1066
## [0.10.34] - 2026-01-06
1167

1268
### Changed

‎extensions/git-id-switcher/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
<a href="https://open-vsx.org/extension/nullvariant/git-id-switcher"><img src="https://img.shields.io/open-vsx/v/nullvariant/git-id-switcher" alt="Open VSX Registry"></a>
1717
<a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-yellow.svg" alt="License: MIT"></a>
1818
<a href="https://securityscorecards.dev/viewer/?uri=github.com/nullvariant/nullvariant-vscode-extensions"><img src="https://api.securityscorecards.dev/projects/github.com/nullvariant/nullvariant-vscode-extensions/badge" alt="OpenSSF Scorecard"></a>
19+
<a href="https://www.bestpractices.dev/projects/11709"><img src="https://www.bestpractices.dev/projects/11709/badge" alt="OpenSSF Best Practices"></a>
1920
<br>
2021
🌐 Languages: <b>🇺🇸</b> <a href="https://github.com/nullvariant/nullvariant-vscode-extensions/blob/main/extensions/git-id-switcher/docs/i18n/ja/README.md">🇯🇵</a> <a href="https://github.com/nullvariant/nullvariant-vscode-extensions/blob/main/extensions/git-id-switcher/docs/i18n/zh-CN/README.md">🇨🇳</a> <a href="https://github.com/nullvariant/nullvariant-vscode-extensions/blob/main/extensions/git-id-switcher/docs/i18n/zh-TW/README.md">🇹🇼</a> <a href="https://github.com/nullvariant/nullvariant-vscode-extensions/blob/main/extensions/git-id-switcher/docs/i18n/ko/README.md">🇰🇷</a> <a href="https://github.com/nullvariant/nullvariant-vscode-extensions/blob/main/extensions/git-id-switcher/docs/i18n/de/README.md">🇩🇪</a> <a href="https://github.com/nullvariant/nullvariant-vscode-extensions/blob/main/extensions/git-id-switcher/docs/i18n/fr/README.md">🇫🇷</a> <a href="https://github.com/nullvariant/nullvariant-vscode-extensions/blob/main/extensions/git-id-switcher/docs/i18n/es/README.md">🇪🇸</a> <a href="https://github.com/nullvariant/nullvariant-vscode-extensions/blob/main/extensions/git-id-switcher/docs/i18n/pt-BR/README.md">🇧🇷</a> <a href="https://github.com/nullvariant/nullvariant-vscode-extensions/blob/main/extensions/git-id-switcher/docs/i18n/it/README.md">🇮🇹</a> <a href="https://github.com/nullvariant/nullvariant-vscode-extensions/blob/main/extensions/git-id-switcher/docs/i18n/ru/README.md">🇷🇺</a> <a href="https://github.com/nullvariant/nullvariant-vscode-extensions/blob/main/extensions/git-id-switcher/docs/i18n/pl/README.md">🇵🇱</a> <a href="https://github.com/nullvariant/nullvariant-vscode-extensions/blob/main/extensions/git-id-switcher/docs/i18n/tr/README.md">🇹🇷</a> <a href="https://github.com/nullvariant/nullvariant-vscode-extensions/blob/main/extensions/git-id-switcher/docs/i18n/cs/README.md">🇨🇿</a> <a href="https://github.com/nullvariant/nullvariant-vscode-extensions/blob/main/extensions/git-id-switcher/docs/i18n/hu/README.md">🇭🇺</a> <a href="https://github.com/nullvariant/nullvariant-vscode-extensions/blob/main/extensions/git-id-switcher/docs/i18n/bg/README.md">🇧🇬</a> <a href="https://github.com/nullvariant/nullvariant-vscode-extensions/blob/main/extensions/git-id-switcher/docs/i18n/uk/README.md">🇺🇦</a> ... <a href="https://github.com/nullvariant/nullvariant-vscode-extensions/blob/main/extensions/git-id-switcher/docs/LANGUAGES.md">+8 more</a>
2122
</td>

‎extensions/git-id-switcher/docs/i18n/ain/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
<a href="https://open-vsx.org/extension/nullvariant/git-id-switcher"><img src="https://img.shields.io/open-vsx/v/nullvariant/git-id-switcher" alt="Open VSX Registry"></a>
3535
<a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-yellow.svg" alt="License: MIT"></a>
3636
<a href="https://securityscorecards.dev/viewer/?uri=github.com/nullvariant/nullvariant-vscode-extensions"><img src="https://api.securityscorecards.dev/projects/github.com/nullvariant/nullvariant-vscode-extensions/badge" alt="OpenSSF Scorecard"></a>
37+
<a href="https://www.bestpractices.dev/projects/11709"><img src="https://www.bestpractices.dev/projects/11709/badge" alt="OpenSSF Best Practices"></a>
3738
<br>
3839
🌐 イタㇰ: <a href="../en/README.md">🇺🇸</a> <a href="../ja/README.md">🇯🇵</a> <a href="../zh-CN/README.md">🇨🇳</a> <a href="../zh-TW/README.md">🇹🇼</a> <a href="../ko/README.md">🇰🇷</a> <a href="../de/README.md">🇩🇪</a> <a href="../fr/README.md">🇫🇷</a> <a href="../es/README.md">🇪🇸</a> <a href="../pt-BR/README.md">🇧🇷</a> <a href="../it/README.md">🇮🇹</a> <a href="../ru/README.md">🇷🇺</a> <a href="../pl/README.md">🇵🇱</a> <a href="../tr/README.md">🇹🇷</a> <a href="../cs/README.md">🇨🇿</a> <a href="../hu/README.md">🇭🇺</a> <a href="../bg/README.md">🇧🇬</a> <a href="../uk/README.md">🇺🇦</a> ... <a href="../../LANGUAGES.md">+8</a>
3940
</td>

0 commit comments

Comments
 (0)