 thc1006
|
5a36aa23b7
|
fix: supply chain hardening — pin actions, images, and fix secret logging
Supply chain:
- Pin GitHub Actions to stable releases instead of @master/@main:
trivy-action@0.28.0, snyk@0.4.0, sonarcloud@v3, dependency-check@v6
- Update EOL actions: upload-artifact v3→v4, codeql/upload-sarif v2→v3,
codecov v3→v4
- Pin container images to specific tags instead of :latest:
kubectl:1.31, vault:1.17, prometheus:v3.2, jaeger:1.62, tempo:2.7,
sonarqube:10.8-community, trivy:0.58.0, trufflehog:3.88, uv:0.6,
temporalio auto-setup:1.26, temporalio ui:2.33
Security:
- Replace echo of secrets in CI examples with env var injection pattern
(secrets-management SKILL.md)
Misc:
- Fix CRLF → LF line endings in deployment-engineer.md
|
2026-04-19 11:13:46 +00:00 |
|