chore(dev): apply ci security updates

[StepSecurity] Apply security best practices Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
sgammon · Aug 14, 2023 · 53cba49 · 53cba49
1 parent 57b2ac0
commit 53cba49
Show file tree

Hide file tree

Showing 4 changed files with 16 additions and 6 deletions.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -9,3 +9,13 @@ updates:
  directory: /
  schedule:
  interval: daily
+
+ - package-ecosystem: gomod
+ directory: /
+ schedule:
+ interval: daily
+
+ - package-ecosystem: maven
+ directory: /
+ schedule:
+ interval: daily
diff --git a/.github/workflows/module.build.yml b/.github/workflows/module.build.yml
@@ -134,14 +134,14 @@ jobs:
  with:
  egress-policy: audit
  - name: "Setup: Checkout"
- uses: actions/checkout@v3
+ uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
  - name: "Setup: msbuild"
- uses: microsoft/setup-msbuild@v1.1
+ uses: microsoft/setup-msbuild@34cfbaee7f672c76950673338facd8a73f637506 # v1.1.3
  if: ${{ contains(inputs.runner, 'windows') }}
  - name: "Setup: Bazel"
- uses: bazelbuild/setup-bazelisk@v2
+ uses: bazelbuild/setup-bazelisk@95c9bf48d0c570bb3e28e57108f3450cd67c1a44 # v2.0.0
  - name: "Setup: Cache"
- uses: actions/cache@v3
+ uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
  with:
  path: "~/.cache/bazel"
  key: bazel-v2

diff --git a/.github/workflows/on.pr.yml b/.github/workflows/on.pr.yml
@@ -30,7 +30,7 @@ jobs:
  uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
  - name: "Report: Dependency Graph"
  continue-on-error: true
- uses: advanced-security/maven-dependency-submission-action@v3
+ uses: advanced-security/maven-dependency-submission-action@d682d5d68a398c90e9b35f8c564cd8e1918d6a24 # v3.0.1
 
  dependency-review:
  name: "Dependency Review"

diff --git a/.github/workflows/on.push.yml b/.github/workflows/on.push.yml
@@ -27,7 +27,7 @@ jobs:
  uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
  - name: "Report: Dependency Graph"
  continue-on-error: true
- uses: advanced-security/maven-dependency-submission-action@v3
+ uses: advanced-security/maven-dependency-submission-action@d682d5d68a398c90e9b35f8c564cd8e1918d6a24 # v3.0.1
 
  build:
  name: "Build (${{ matrix.label }})"