Skip to content

chore: supply chain hardening#94

Merged
grandizzy merged 2 commits intomasterfrom
georgen/supply-chain-hardening
Apr 14, 2026
Merged

chore: supply chain hardening#94
grandizzy merged 2 commits intomasterfrom
georgen/supply-chain-hardening

Conversation

@decofe
Copy link
Copy Markdown
Member

@decofe decofe commented Apr 14, 2026

Supply chain hardening from dependency scan.

Changes

  • SHA-pin all GitHub Actions across ci.yml, sync.yml, update.yml
  • Fix template injection: move ${{ matrix.flags }} to env var in ci.yml
  • Add Dependabot cooldown (7 days)
  • Fix typos action version comment (v1v1.45.0)

Prompted by: georgen

Co-Authored-By: grandizzy <38490174+grandizzy@users.noreply.github.com>
@grandizzy grandizzy marked this pull request as ready for review April 14, 2026 09:58
Comment thread scripts/sync.sh Outdated

# Clone specs repo and copy interface specs
git clone --depth 1 https://github.com/tempoxyz/tempo.git specs
git clone --depth 1 --branch v1.5.3 https://github.com/tempoxyz/tempo.git specs
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
git clone --depth 1 --branch v1.5.3 https://github.com/tempoxyz/tempo.git specs
git clone --depth 1 https://github.com/tempoxyz/tempo.git specs

there is relatively low risk imo with this, it is more convenient to leave this unpinned given it is specifically meant as being a "nightly", the releases of tempo-std (on request) are considered stable points tied to a Tempo release

@grandizzy grandizzy merged commit 8f68444 into master Apr 14, 2026
22 checks passed
@grandizzy grandizzy deleted the georgen/supply-chain-hardening branch April 14, 2026 10:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants