mirror of
https://github.com/docker/setup-buildx-action.git
synced 2026-11-14 00:37:15 +08:00
265af8a183
- Pin all unpinned action refs to immutable commit SHAs (tag immutability verified via GitHub rulesets API for each repo; all returned false/empty so SHA pinning applied) - Add top-level `permissions: contents: read` to ci.yml, test.yml, and validate.yml (publish.yml already had per-job permissions) - Add `persist-credentials: false` to all actions/checkout steps to prevent credential leakage through GitHub Actions artifacts Findings addressed: unpinned-uses (40 errors), excessive-permissions (27 warnings), artipacked (26 warnings) — 93 findings total Actions pinned: actions/checkout v4 -> 34e114876b0b11c390a56381ad16ebd13914f8d5 actions/publish-immutable-action v0.0.4 -> 4bc8754ffc40f27910afb20287dbbbb675a4e978 docker/setup-qemu-action v3 -> c7c53464625b32c7a7e944ae62b3e17d2b600130 docker/build-push-action v6 -> 10e90e3645eae34f1e60eeb005ba3a3d33f178e8 docker/build-push-action master -> 789f68658055d3ca993799b232b5c46dfe3f114d docker/bake-action v5 -> 4a9a8d494466d37134e2bfca2d3a8de8fb2681ad crazy-max/ghaction-dump-context v2 -> 5355a8e5e6ac5a302e746a1c4b7747a0393863c8 codecov/codecov-action v4 -> b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 crazy-max/.github install-k3s -> already SHA-pinned (skipped)
