4 ms·
Maybe there's a future Dependabot feature to create FYI issues when in use tags change?
by opello 1y ago
Maybe there's a future Dependabot feature to create FYI issues when in use tags change?
- wereHamster 1y agosecurityscorecard is easy to integrate (it's a cli tool or you run it as a github action), one of the checks it performs is "Pinned-Dependencies": https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies https://github.com/ossf/scorecard/blob/main/docs/checks.md#p.... Checks that fail generate an security alert under Security -> Code scanning.
- OptionOfT 1y agoIs it transitive? > The check works by looking for unpinned dependencies in Dockerfiles, shell scripts, and GitHub workflows which are used during the build and release process of a project. Does it detect an unpinned (eg a Docker tag) of a pinned dependency.