actions/setup-uv
10
0
Fork 0
mirror of https://github.com/astral-sh/setup-uv.git synced 2026-04-21 11:00:14 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Fix code scanning alerts: verify bot sender, correct version comments, add persist-credentials

Browse source
This commit is contained in:
eifinger-bot 2026-03-06 17:17:50 +00:00
parent 01e092d495
commit c23778d3ec
1 changed files with 6 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

9
.github/workflows/dependabot-build.yml vendored
View file

@ -10,15 +10,16 @@ permissions:
jobs: jobs:
build: build:
runs-on: ubuntu-latest runs-on: ubuntu-latest
if: github.actor == 'dependabot[bot]' if: github.event.sender.login == 'dependabot[bot]' && github.event.sender.type == 'Bot'
steps: steps:
- name: Checkout PR branch - name: Checkout PR branch
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with: with:
ref: ${{ github.head_ref }} ref: ${{ github.head_ref }}
persist-credentials: false
- name: Setup Node.js - name: Setup Node.js
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v4 uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
with: with:
node-version-file: .nvmrc node-version-file: .nvmrc
cache: npm cache: npm
@ -31,6 +32,8 @@ jobs:
- name: Commit built dist - name: Commit built dist
uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5 uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with: with:
commit_message: "Build dist for Dependabot update" commit_message: "Build dist for Dependabot update"
file_pattern: dist/ file_pattern: dist/