Repository navigation
Zizmor fixes - #6
Conversation
|
@copilot resolve the merge conflicts in this pull request. Please use the latest checkout version, but use pinned commits. |
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The Dependabot auto-merge workflow cannot obtain required write permissions and may merge before checks complete.
Review effort: Lite
Findings: 1
Open (1)
What changed in this PR
This PR hardens GitHub Actions workflows and adds automatic merging for Dependabot Actions updates.
Changes:
- Pins third-party actions and restricts permissions.
- Improves workflow input handling.
- Adds Dependabot cooldown configuration.
- Adds Dependabot Actions auto-merge automation.
| File | Summary |
|---|---|
.github/workflows/dependabot-auto-merge-actions.yml |
Adds Dependabot approval and merge automation; requires fixes for token permissions and merge timing. |
.github/workflows/auto-publish-in-azure.yml |
Hardens permissions, action references, and shell inputs. |
.github/dependabot.yml |
Adds a seven-day dependency cooldown. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| # Other Dependabot PRs (npm, nuget, …) are left untouched. | ||
|
|
||
| name: Dependabot auto-merge GitHub Actions | ||
| on: pull_request |
# Conflicts: # .github/workflows/auto-publish-in-azure.yml Co-authored-by: bb-froggy <587120+bb-froggy@users.noreply.github.com>
Done in 1c602b4. I merged the latest |
🌈 zizmor scan results✅ zizmor found no issues in this repository's GitHub Actions. |
Fixes for zizmor findings and auto-merge dependabot PRs if they affect only actions