Skip to content

fix: update action version annotations with pinact - #11

Merged
tomtwinkle merged 1 commit into
masterfrom
fix/supply-chain-takumi-guard-sha-pinning
Apr 3, 2026
Merged

tomtwinkle merged 1 commit into
masterfrom
fix/supply-chain-takumi-guard-sha-pinning

Conversation

@tomtwinkle

Copy link
Copy Markdown

変更内容

GitHub Actions ワークフローのバージョンアノテーションを pinact で更新しました。

更新内容(SHA は変更なし、コメントのバージョン表記を修正)

Action Before After
actions/checkout # v6 # v6.0.2
actions/setup-node # v6 # v6.3.0
flatt-security/setup-takumi-guard-npm # v1.0.0 # v1

変更ファイル

  • .github/workflows/asset-size.yml
  • .github/workflows/tests.yml

🤖 Auto-generated by supply chain fix using pinact

- actions/checkout: v6 -> v6.0.2
- actions/setup-node: v6 -> v6.3.0
- flatt-security/setup-takumi-guard-npm: v1.0.0 -> v1 (correct annotation)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the human-readable version annotations (comments) for pinned GitHub Actions used in the repository’s CI workflows, using pinact, without changing the pinned commit SHAs.

Changes:

  • Update actions/checkout annotation from # v6 to # v6.0.2 (SHA unchanged)
  • Update actions/setup-node annotation from # v6 to # v6.3.0 (SHA unchanged)
  • Update flatt-security/setup-takumi-guard-npm annotation from # v1.0.0 to # v1 (SHA unchanged)

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
.github/workflows/tests.yml Refreshes action version comments for checkout/setup-node/takumi-guard while keeping SHA pins.
.github/workflows/asset-size.yml Refreshes action version comments for checkout/takumi-guard while keeping SHA pins.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@onodera0314
onodera0314 requested a review from yutafujita April 3, 2026 08:36
@onodera0314

Copy link
Copy Markdown

@yutafujita
このリポジトリのサプライチェーン攻撃対策をされていそうなのでレビュアーに指定させていただきました。
レビューお願いします 🙏

@yutafujita yutafujita left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tomtwinkle
tomtwinkle merged commit be43256 into master Apr 3, 2026
16 checks passed
@tomtwinkle
tomtwinkle deleted the fix/supply-chain-takumi-guard-sha-pinning branch April 3, 2026 10:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants