Skip to content

ci: security updates - #207

Open
aliziel wants to merge 4 commits into
devfrom
ci/security-updates
Open

ci: security updates#207
aliziel wants to merge 4 commits into
devfrom
ci/security-updates

Conversation

@aliziel

@aliziel aliziel commented Jul 3, 2026

Copy link
Copy Markdown
Collaborator

Note

See NASA-IMPACT/veda-keycloak#253 for more detail on OSSF Scorecard + Dependabot configs, removed repeated detail to help reviewers and better highlight repo-specific deltas.


  • Dependabot version updates added:
    • pip (deploy script dependencies)
    • github-actions (CI)
  • Commit SHAs
    • Pinned to latest release per major version
  • OSSF Scorecard added
  • Token permissions
    • Move write permissions from top-level (all jobs) to specific job required
    • Remove excess write permissions

@botanical botanical left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm after merge conflicts are resolved. Sorry to delay the review!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants