You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@magpie.apache.org by po...@apache.org on 2026/07/27 12:40:35 UTC
(magpie) branch main updated: fix(workflow-security-audit): use full 40-char SHA in pin example (#967)
This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/magpie.git
The following commit(s) were added to refs/heads/main by this push:
new 346ea87f fix(workflow-security-audit): use full 40-char SHA in pin example (#967)
346ea87f is described below
commit 346ea87fa4772981c913177d1f55841a3266d163
Author: Shaurya Srivastava <10...@users.noreply.github.com>
AuthorDate: Mon Jul 27 18:10:28 2026 +0530
fix(workflow-security-audit): use full 40-char SHA in pin example (#967)
The unpinned-actions remediation showed a 39-character string that does
not parse as a git SHA. Restore the missing final hex digit so the
example matches the real actions/checkout v4.2.2 commit.
Signed-off-by: shaurya2k06 <sh...@gmail.com>
---
skills/workflow-security-audit/SKILL.md | 2 +-
uv.lock | 16 ++++++++--------
2 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/skills/workflow-security-audit/SKILL.md b/skills/workflow-security-audit/SKILL.md
index 36b18618..0ca160ea 100644
--- a/skills/workflow-security-audit/SKILL.md
+++ b/skills/workflow-security-audit/SKILL.md
@@ -235,7 +235,7 @@ changing the tag.
floating reference.
**Suggested remediation:** pin to the full commit SHA of the version
-you trust — e.g. `actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af68`
+you trust — e.g. `actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683`
— and add a comment with the semantic version for readability.
### Fork-secret exposure (`fork-secrets`)
diff --git a/uv.lock b/uv.lock
index b70568a4..f0fe7246 100644
--- a/uv.lock
+++ b/uv.lock
@@ -369,7 +369,7 @@ dev = [
[package.metadata.requires-dev]
dev = [
- { name = "mypy", specifier = ">=2.1.0" },
+ { name = "mypy", specifier = ">=2.3.0" },
{ name = "pytest", specifier = ">=9.1.1" },
{ name = "ruff", specifier = ">=0.15.21" },
]
@@ -495,7 +495,7 @@ dev = [
[package.metadata.requires-dev]
dev = [
- { name = "mypy", specifier = ">=2.1.0" },
+ { name = "mypy", specifier = ">=2.3.0" },
{ name = "pytest", specifier = ">=9.1.1" },
{ name = "ruff", specifier = ">=0.15.21" },
]
@@ -945,7 +945,7 @@ provides-extras = ["mcp"]
[package.metadata.requires-dev]
dev = [
{ name = "mcp", specifier = ">=1.28.1" },
- { name = "mypy", specifier = ">=2.1.0" },
+ { name = "mypy", specifier = ">=2.3.0" },
{ name = "pytest", specifier = ">=9.1.1" },
{ name = "ruff", specifier = ">=0.15.21" },
]
@@ -1359,7 +1359,7 @@ dev = [
[package.metadata.requires-dev]
dev = [
- { name = "mypy", specifier = ">=2.1.0" },
+ { name = "mypy", specifier = ">=2.3.0" },
{ name = "pytest", specifier = ">=9.1.1" },
{ name = "ruff", specifier = ">=0.15.21" },
]
@@ -1570,7 +1570,7 @@ dev = [
[package.metadata.requires-dev]
dev = [
- { name = "mypy", specifier = ">=2.1.0" },
+ { name = "mypy", specifier = ">=2.3.0" },
{ name = "pytest", specifier = ">=9.1.1" },
{ name = "ruff", specifier = ">=0.15.21" },
]
@@ -1612,7 +1612,7 @@ dev = [
[package.metadata.requires-dev]
dev = [
- { name = "mypy", specifier = ">=2.1.0" },
+ { name = "mypy", specifier = ">=2.3.0" },
{ name = "pytest", specifier = ">=9.1.1" },
{ name = "ruff", specifier = ">=0.15.21" },
]
@@ -1633,7 +1633,7 @@ dev = [
[package.metadata.requires-dev]
dev = [
- { name = "mypy", specifier = ">=2.1.0" },
+ { name = "mypy", specifier = ">=2.3.0" },
{ name = "pytest", specifier = ">=9.1.1" },
{ name = "ruff", specifier = ">=0.15.21" },
]
@@ -1843,7 +1843,7 @@ dev = [
[package.metadata.requires-dev]
dev = [
- { name = "mypy", specifier = ">=2.1.0" },
+ { name = "mypy", specifier = ">=2.3.0" },
{ name = "pytest", specifier = ">=9.1.1" },
{ name = "ruff", specifier = ">=0.15.21" },
]