From f5dc1c1ad32d1df08ceb40f590d1b1952dbb4a2d Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Wed, 23 Sep 2026 12:50:09 +0000
Subject: [PATCH] Add dependabot config and pin GitHub Actions to a commit SHA (#1073)
---
.github/workflows/docker-scan.yml | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/.github/workflows/docker-scan.yml b/.github/workflows/docker-scan.yml
index 3393658..933aeab 100644
--- a/.github/workflows/docker-scan.yml
+++ b/.github/workflows/docker-scan.yml
@@ -37,7 +37,7 @@
matrix:
tag: [ 'latest', 'alpine' ]
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- name: Scan openidentityplatform/opendj:${{ matrix.tag }} (Trivy)
# unlike the build.yml gate, unfixed CVEs are reported too: surfacing them in
# already-released images is the point of this workflow
@@ -51,7 +51,7 @@
scanners: vuln
cache: false
- name: Upload report to GitHub Security
- uses: github/codeql-action/upload-sarif@v4
+ uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
# upload even if a preceding step failed, but not without a report to upload
if: ${{ always() && hashFiles(format('trivy-{0}.sarif', matrix.tag)) != '' }}
with:
--
Gitblit v1.10.0