 Evgeny Vereshchagin
|
5570313421
|
ci: pin labeler
Turns out GHActions where `pull_request_target` is used are capable
of pwning repositories: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
labeler doesn't check out the source code or build anything so
it's safe in its current form but to avoid surprises let's just pin
it to the latest version. It's annoying to manage dependencies like this
manually so additionally dependabot.yml is introduced to make it
easier to keep GHActions up to date more or less automatically:
https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/keeping-your-actions-up-to-date-with-dependabot
|
2021-11-11 10:19:06 +00:00 |
|
 Zbigniew Jędrzejewski-Szmek
|
186b9041ae
|
ci: use LGPLv2+ for all our ci configuration
|
2021-10-01 14:45:00 +02:00 |
|
|
Zbigniew Jędrzejewski-Szmek
|
43d6fcc09f
|
github: use the same headers on yaml files
Also adjust the mention of location of mkosi files,
follow-up for d55ad7fe96.
|
2021-10-01 14:45:00 +02:00 |
|
 Jameer Pathan
|
63f48ab3fa
|
GH Actions: Fix labeler bot
|
2021-02-19 14:51:59 +09:00 |
|
|
Jameer Pathan
|
292420ce4b
|
Add Pull Request Labeler
|
2020-12-14 09:43:38 +09:00 |
|