Repository navigation
Add Dependabot and pin GitHub Actions to commit SHAs - #72
Merged
Merged
Conversation
Dependabot now checks GitHub Actions, Maven, Gradle (IntelliJ plugin) and npm (VS Code extension) weekly, with updates grouped per ecosystem. All actions in the CI and release workflows are updated to their latest releases and pinned to full commit SHAs with a version comment, so Dependabot can keep them current. CI now runs with read-only contents permission. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
koppor
marked this pull request as ready for review
October 10, 2026 13:50
Collaborator
Author
|
I merge to keep things moving. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/dependabot.ymlwith weekly, per-ecosystem grouped updates for GitHub Actions, Maven (root), Gradle (intellij-plugin) and npm (vscode-extension).ci.ymlandrelease.ymlto their latest releases and pin them to full commit SHAs with a# vX.Y.Zcomment, so Dependabot keeps both the SHA and the comment current.permissions: contents: readto the CI workflow (release already declarescontents: write).Each SHA was resolved from the release tag via the GitHub API and verified to point at the tagged commit.
Test plan
🤖 Generated with Claude Code