Jussi Kukkonen f005825955 workflows: Stop pinning actions that are not security relevant ... These workflows have no real security relevance (runtime build or test) in the sense that a compromise in the dependencies could compromise python-tuf security: * scorecards * dependency-review * codeql-analysis Stop pinning the actions used in them (except the common actions that are used everyewhere like actions/checkout: use the same version of those everywhere). The benefit here is fewer Dependabot PRs: If we had done this from the start we'd have skipped ~70 PRs by now. The interesting permissions used in these workflows are * security-events: write This can add things onto the "Security" tab in GitHub * id-token: write This allows OIDC authentication, but only as this specific workflow These permissions look completely acceptable to me. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>		2023-10-02 13:34:24 +03:00
..
workflows	workflows: Stop pinning actions that are not security relevant	2023-10-02 13:34:24 +03:00
dependabot.yml	Have dependabot also monitor actions	2021-09-08 10:56:16 +01:00
ISSUE_TEMPLATE.md	Add issue and pull request templates	2017-09-28 17:01:56 -04:00
PULL_REQUEST_TEMPLATE.md	Fix automatic issue closing	2020-10-07 13:11:12 +03:00