From 6f1bdc79428b8ef19f4c48894f30277efc98742a Mon Sep 17 00:00:00 2001 From: Oliver Kurz Date: Tue, 30 Jun 2026 14:24:23 +0200 Subject: [PATCH 1/2] feat(ci): pin GitHub Actions by commit hash Motivation: Secure GitHub Actions workflows against git tag hijacking attacks. Design Choices: Replace version tags with full 40-character SHA-1 hashes. Preserve tags as comments for easy reference. Benefits: Ensures workflow immutability and compliance with security best practices. Related issue: https://progress.opensuse.org/issues/203049 --- .github/dependabot.yml | 14 ++++++++++++++ .github/workflows/integration.yaml | 2 +- 2 files changed, 15 insertions(+), 1 deletion(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..e09f7777 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,14 @@ +version: 2 +updates: + - package-ecosystem: 'github-actions' + directory: '/' + schedule: + interval: 'weekly' + day: 'monday' + cooldown: + default-days: 7 + open-pull-requests-limit: 5 + groups: + all-actions: + patterns: + - "*" diff --git a/.github/workflows/integration.yaml b/.github/workflows/integration.yaml index 85aee11b..86955659 100644 --- a/.github/workflows/integration.yaml +++ b/.github/workflows/integration.yaml @@ -10,7 +10,7 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: integration run: | podman pull registry.opensuse.org/devel/openqa/ci/containers/serviced From c1412a25342e9c26e04db53abc3286417a2bbac7 Mon Sep 17 00:00:00 2001 From: Oliver Kurz Date: Tue, 30 Jun 2026 14:45:49 +0200 Subject: [PATCH 2/2] fix(ci): format inline comments in workflows to pass yamllint Motivation: Workflow files failed yamllint checkstyle checks due to inline comments only having 1 space instead of the expected 2. Design Choices: Reformat comment prefixes to use 2 spaces before '#'. Benefits: Fixes CI checkstyle/yaml-syntax validation errors. Related issue: https://progress.opensuse.org/issues/203049 --- .github/workflows/integration.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/integration.yaml b/.github/workflows/integration.yaml index 86955659..b4dd36b6 100644 --- a/.github/workflows/integration.yaml +++ b/.github/workflows/integration.yaml @@ -10,7 +10,7 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: integration run: | podman pull registry.opensuse.org/devel/openqa/ci/containers/serviced