From 85d44bfcbff65e847e918e6a67daf848e218fcef Mon Sep 17 00:00:00 2001 From: StepSecurity Bot Date: Tue, 6 Jun 2023 14:03:59 +0000 Subject: [PATCH 1/4] [StepSecurity] Apply security best practices resolve: #472 Signed-off-by: StepSecurity Bot --- .github/dependabot.yml | 11 +++++++++++ .github/workflows/ci-actions.yml | 7 +++++-- 2 files changed, 16 insertions(+), 2 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000000..c5f0e168bb --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: daily + + - package-ecosystem: maven + directory: / + schedule: + interval: daily diff --git a/.github/workflows/ci-actions.yml b/.github/workflows/ci-actions.yml index 1505526eea..7d074201df 100644 --- a/.github/workflows/ci-actions.yml +++ b/.github/workflows/ci-actions.yml @@ -5,6 +5,9 @@ on: pull_request: branches: [ master ] +permissions: + contents: read + jobs: build: name: "Build CDI TCK - JDK ${{matrix.java}}" @@ -14,9 +17,9 @@ jobs: matrix: java: [11, 17] steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0 - name: Set up JDK ${{ matrix.java }} - uses: actions/setup-java@v1.4.3 + uses: actions/setup-java@d202f5dbf7256730fb690ec59f6381650114feb2 # v1.4.3 with: java-version: ${{ matrix.java }} - name: "Maven install(staging)" From d8bb25b670712ba39088f9667bda251f37ea3e17 Mon Sep 17 00:00:00 2001 From: Scott M Stark Date: Thu, 30 Nov 2023 12:29:37 -0600 Subject: [PATCH 2/4] Change frequency to weekly --- .github/dependabot.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index c5f0e168bb..22bc9720f6 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -8,4 +8,4 @@ updates: - package-ecosystem: maven directory: / schedule: - interval: daily + interval: weekly From 5e5aedc21c3e1a1080e0a50e60ad0ff016132e4b Mon Sep 17 00:00:00 2001 From: Scott M Stark Date: Thu, 30 Nov 2023 12:32:13 -0600 Subject: [PATCH 3/4] Update to latest checkout and setup-java actions --- .github/workflows/ci-actions.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci-actions.yml b/.github/workflows/ci-actions.yml index 7d074201df..9da5347650 100644 --- a/.github/workflows/ci-actions.yml +++ b/.github/workflows/ci-actions.yml @@ -17,9 +17,9 @@ jobs: matrix: java: [11, 17] steps: - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0 + - uses: actions/checkout@v4.1.1 - name: Set up JDK ${{ matrix.java }} - uses: actions/setup-java@d202f5dbf7256730fb690ec59f6381650114feb2 # v1.4.3 + uses: actions/setup-java@v4.0.0 with: java-version: ${{ matrix.java }} - name: "Maven install(staging)" From 81e0c900256f65fcba3ea5040f7ad134f8644703 Mon Sep 17 00:00:00 2001 From: Scott M Stark Date: Thu, 30 Nov 2023 12:34:06 -0600 Subject: [PATCH 4/4] add distribution: 'temurin' --- .github/workflows/ci-actions.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ci-actions.yml b/.github/workflows/ci-actions.yml index 9da5347650..90abd3e3bf 100644 --- a/.github/workflows/ci-actions.yml +++ b/.github/workflows/ci-actions.yml @@ -21,6 +21,7 @@ jobs: - name: Set up JDK ${{ matrix.java }} uses: actions/setup-java@v4.0.0 with: + distribution: 'temurin' java-version: ${{ matrix.java }} - name: "Maven install(staging)" run: |