From 2417b88a3617593dbff6cb0039ce969a505cf717 Mon Sep 17 00:00:00 2001 From: Henrik Widlund <4659350+henrikwidlund@users.noreply.github.com> Date: Fri, 24 Jul 2026 15:29:13 +0200 Subject: [PATCH 1/3] ci: pin GitHub Actions to commit SHA, set persist-credentials: false, add dependabot --- .github/dependabot.yml | 8 ++++++++ .github/workflows/asyncapi.yml | 14 +++++++------- .github/workflows/deploy_mdbook.yml | 6 +++--- .github/workflows/openapi.yml | 8 +++++--- 4 files changed, 23 insertions(+), 13 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..140c921 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,8 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + cooldown: + default-days: 14 diff --git a/.github/workflows/asyncapi.yml b/.github/workflows/asyncapi.yml index 0a24338..dc9444b 100644 --- a/.github/workflows/asyncapi.yml +++ b/.github/workflows/asyncapi.yml @@ -28,20 +28,20 @@ jobs: contents: write # To push a branch steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Validate websocket-api - uses: WaleedAshraf/asyncapi-github-action@v0.0.10 + uses: WaleedAshraf/asyncapi-github-action@d31f1627ac7c24132e7c4e4b89948d43b619685a # v0.0.10 with: filepath: './core-api/websocket/UCR-core-asyncapi.yaml' - name: Validate integration-api - uses: WaleedAshraf/asyncapi-github-action@v0.0.10 + uses: WaleedAshraf/asyncapi-github-action@d31f1627ac7c24132e7c4e4b89948d43b619685a # v0.0.10 with: filepath: './integration-api/UCR-integration-asyncapi.yaml' - name: Validate dock-api - uses: WaleedAshraf/asyncapi-github-action@v0.0.10 + uses: WaleedAshraf/asyncapi-github-action@d31f1627ac7c24132e7c4e4b89948d43b619685a # v0.0.10 with: filepath: './dock-api/UCD2-asyncapi.yaml' @@ -73,7 +73,7 @@ jobs: - name: Deploy core API GH page if: github.ref == 'refs/heads/main' || contains(github.ref, 'tags/v') - uses: JamesIves/github-pages-deploy-action@v4 + uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4.8.0 with: branch: gh-pages folder: ./static/api/ws @@ -81,7 +81,7 @@ jobs: - name: Deploy integration API GH page if: github.ref == 'refs/heads/main' || contains(github.ref, 'tags/v') - uses: JamesIves/github-pages-deploy-action@v4 + uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4.8.0 with: branch: gh-pages folder: ./static/api/integration @@ -89,7 +89,7 @@ jobs: - name: Deploy dock API GH page if: github.ref == 'refs/heads/main' || contains(github.ref, 'tags/v') - uses: JamesIves/github-pages-deploy-action@v4 + uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4.8.0 with: branch: gh-pages folder: ./static/api/dock diff --git a/.github/workflows/deploy_mdbook.yml b/.github/workflows/deploy_mdbook.yml index 83c1f75..6bb4c7f 100644 --- a/.github/workflows/deploy_mdbook.yml +++ b/.github/workflows/deploy_mdbook.yml @@ -20,7 +20,7 @@ jobs: permissions: contents: write # To push a branch steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 - name: Install mdbook @@ -40,7 +40,7 @@ jobs: - name: Cache cargo install id: cache-cargo-install - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: | ~/.cargo/bin @@ -58,7 +58,7 @@ jobs: mdbook build - name: Deploy to GitHub Pages - uses: JamesIves/github-pages-deploy-action@v4 + uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4.8.0 with: branch: gh-pages folder: book diff --git a/.github/workflows/openapi.yml b/.github/workflows/openapi.yml index a5e1873..609d847 100644 --- a/.github/workflows/openapi.yml +++ b/.github/workflows/openapi.yml @@ -22,7 +22,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Validate with redocli CLI run: | docker pull redocly/cli @@ -35,12 +37,12 @@ jobs: needs: [ validate ] steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Prepare GH page deployment run: | cp ./core-api/rest/UCR-core-openapi.yaml ./core-api/rest/swagger-ui - name: Deploy core API GH page - uses: JamesIves/github-pages-deploy-action@v4 + uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4.8.0 with: branch: gh-pages folder: ./core-api/rest/swagger-ui From cab56ea8dfc0674206f6884cc62fe041aaacdf84 Mon Sep 17 00:00:00 2001 From: Henrik Widlund <4659350+henrikwidlund@users.noreply.github.com> Date: Fri, 24 Jul 2026 15:41:35 +0200 Subject: [PATCH 2/3] chore: use daily dependabot update interval --- .github/dependabot.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 140c921..7b8a83e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -3,6 +3,6 @@ updates: - package-ecosystem: "github-actions" directory: "/" schedule: - interval: "weekly" + interval: "daily" cooldown: default-days: 14 From cc6a7d8de287c31453afbfcafafe5a9bc450d86a Mon Sep 17 00:00:00 2001 From: Henrik Widlund <4659350+henrikwidlund@users.noreply.github.com> Date: Fri, 24 Jul 2026 16:09:53 +0200 Subject: [PATCH 3/3] ci: set persist-credentials: false on remaining checkout steps JamesIves/github-pages-deploy-action manages its own git remote auth via its token input (defaulting to github.token) and explicitly unsets any checkout-persisted credential before pushing, so it does not depend on persist-credentials. --- .github/workflows/asyncapi.yml | 2 ++ .github/workflows/deploy_mdbook.yml | 1 + .github/workflows/openapi.yml | 2 ++ 3 files changed, 5 insertions(+) diff --git a/.github/workflows/asyncapi.yml b/.github/workflows/asyncapi.yml index dc9444b..b46aa45 100644 --- a/.github/workflows/asyncapi.yml +++ b/.github/workflows/asyncapi.yml @@ -29,6 +29,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Validate websocket-api uses: WaleedAshraf/asyncapi-github-action@d31f1627ac7c24132e7c4e4b89948d43b619685a # v0.0.10 diff --git a/.github/workflows/deploy_mdbook.yml b/.github/workflows/deploy_mdbook.yml index 6bb4c7f..cbcb03d 100644 --- a/.github/workflows/deploy_mdbook.yml +++ b/.github/workflows/deploy_mdbook.yml @@ -22,6 +22,7 @@ jobs: steps: - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: + persist-credentials: false fetch-depth: 0 - name: Install mdbook # latest version is not recommended, since it also includes breaking alpha & beta versions diff --git a/.github/workflows/openapi.yml b/.github/workflows/openapi.yml index 609d847..d806399 100644 --- a/.github/workflows/openapi.yml +++ b/.github/workflows/openapi.yml @@ -38,6 +38,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Prepare GH page deployment run: | cp ./core-api/rest/UCR-core-openapi.yaml ./core-api/rest/swagger-ui