Skip to content

Conversation

Copy link
Contributor

Copilot AI commented Nov 26, 2025

Dependabot bump of actions/checkout v5→v6, updated to use commit SHA pinning per repo conventions.

Changes

  • SHA pinning: All actions now reference commit SHAs with version comments
  • Security hardening: Added persist-credentials: false to all actions/checkout usages
  • Pinned super-linter: Changed from @latest to specific v8 SHA
# Before
uses: actions/checkout@v6

# After
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
with:
  persist-credentials: false
Action SHA
actions/checkout 1af3b93b... (v6)
PSModule/Auto-Release eabd5330... (v1)
super-linter/super-linter 2bdd90ed... (v8)
PSModule/GitHub-Script 4f9c58a2... (v1)

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

…ersist-credentials: false

Co-authored-by: MariusStorhaug <17722253+MariusStorhaug@users.noreply.github.com>
Copy link
Contributor Author

Copilot AI commented Nov 26, 2025

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com//advisories
    • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (http block)
  • https://api.github.com/repos/PSModule/Auto-Release/git/ref/tags/v1
    • Triggering command: /usr/bin/curl curl -s REDACTED (http block)
  • https://api.github.com/repos/PSModule/GitHub-Script/git/ref/tags/v1
    • Triggering command: /usr/bin/curl curl -s REDACTED (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Copilot AI changed the title [WIP] Update actions/checkout from v5 to v6 Bump actions/checkout from 5 to 6 with SHA pinning Nov 26, 2025
Copilot AI requested a review from MariusStorhaug November 26, 2025 10:33
@MariusStorhaug MariusStorhaug marked this pull request as ready for review November 26, 2025 12:07
@MariusStorhaug MariusStorhaug merged commit d589584 into dependabot/github_actions/actions/checkout-6 Nov 26, 2025
14 of 17 checks passed
@MariusStorhaug MariusStorhaug deleted the copilot/sub-pr-5 branch November 26, 2025 12:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants