chore(ci): SHA-pin org reusable-workflow caller refs (INFRA-50) #9

2026-07-06T22:10:09Z

amoussa1229 commented

2026-07-06 22:10:09 +00:00

(Migrated from github.com)

Mutable @main on org reusable-workflow caller refs means a single push to .github can alter every consumer repo's CI/CD. Pin each caller ref to the current .github main SHA (fd60e4c) so workflow changes are deliberate and reviewable.

Pins all org-reusable @main refs in this repo (ci, deploy, labeler, dependency-review). No third-party actions/* touched (separate ticket).

INFRA-50

Mutable `@main` on org reusable-workflow caller refs means a single push to `.github` can alter every consumer repo's CI/CD. Pin each caller ref to the current `.github` main SHA (`fd60e4c`) so workflow changes are deliberate and reviewable. Pins all org-reusable `@main` refs in this repo (ci, deploy, labeler, dependency-review). No third-party `actions/*` touched (separate ticket). INFRA-50

github-advanced-security[bot] (Migrated from github.com) reviewed 2026-07-06 22:10:53 +00:00

.github/workflows/dependency-review.yml

					
				@ -4,3 +4,3 @@

				jobs:

				  review:

				    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@main

				    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@fd60e4c9041784f666ac0fdefb9bec3c7fbf5143 # main

github-advanced-security[bot] (Migrated from github.com) commented

2026-07-06 22:10:53 +00:00

CodeQL / Workflow does not contain permissions

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {{}}

Show more details

## CodeQL / Workflow does not contain permissions Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {{}} [Show more details](https://github.com/Sea-Haven-Industries/rustdesk-server/security/code-scanning/3)

This repo is archived. You cannot comment on pull requests.

No reviewers