mirror of
https://github.com/standardnotes/app
synced 2026-10-16 09:14:34 -04:00
b8ccb0f85c
* ci: pin third-party actions to full commit SHAs Pin third-party actions on mutable @master/@main tags in credentialed jobs: - chetan/invalidate-cloudfront-action (web.release.prod.yml) — handed production AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY - convictional/trigger-workflow-and-wait (snjs.pr.yml, e2e jobs) — handed CI_PAT_TOKEN - johnnyhuy/actions-discord-git-webhook (web.release.prod.yml) — handed DISCORD_WEBHOOK_URL A moved tag would run unreviewed code with those credentials. Behaviour unchanged; per GitHub's pin-to-SHA guidance. Signed-off-by: Kobi Hikri <[email protected]> * Apply suggestion from @antsgar --------- Signed-off-by: Kobi Hikri <[email protected]> Co-authored-by: Antonella Sgarlatta <[email protected]> Co-authored-by: Antonella Sgarlatta <[email protected]>