You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This request is specific to GitHub Actions, but it's possible this could be a practice for other package ecosystems.
In WordPress/wordpress-develop, our third-party actions are pinned to a full length commit SHA following the Security Hardening guidelines. Because SHA values are not human readable, an inline comment stating the version number is included at the end of the line (afewexamples).
Dependabot is smart enough to update the SHA value, but does not update the version within the comment. I'm not sure if this is a common practice, but it would be great if Dependabot could also update the inline comment.
The text was updated successfully, but these errors were encountered:
This request is specific to GitHub Actions, but it's possible this could be a practice for other package ecosystems.
In WordPress/wordpress-develop, our third-party actions are pinned to a full length commit SHA following the Security Hardening guidelines. Because SHA values are not human readable, an inline comment stating the version number is included at the end of the line (a few examples).
Dependabot is smart enough to update the SHA value, but does not update the version within the comment. I'm not sure if this is a common practice, but it would be great if Dependabot could also update the inline comment.
The text was updated successfully, but these errors were encountered: