Bump actions/checkout from 5 to 6 - #33
Open
dependabot[bot] wants to merge 1 commit into
Open
DryRunSecurity / Code Policies
succeeded
Nov 21, 2025 in 0s
DryRun Security
Details
Code Policy Results
| Policy | GitHub Action Policy |
|---|---|
| Result | Identified GitHub Actions Risks - Line 16: Uses third-party action golangci/golangci-lint-action@v8 via a mutable version tag. Pin to a specific commit SHA or exact release to reduce supply-chain risk. - Line 18: The linter is configured with version: latest, which fetches a rolling latest binary. This mutability can introduce unexpected changes; pin to a specific version. - Line 15: Uses first-party actions/checkout@v6 via a mutable tag. While first-party, pinning to a commit SHA or exact release is recommended to prevent unexpected updates. - Line 23: Uses first-party actions/checkout@v6 via a mutable tag. Same recommendation as above. - Line 24: Uses first-party actions/setup-go@v6 via a mutable tag. Prefer pinning to a commit SHA or exact release. No secrets usage, run: commands, permissions elevation, or insecure triggers are visible in this patch. |
Loading