From 7a0ee1632795bcc1d5b3c4b461e66d2d4c4dbb76 Mon Sep 17 00:00:00 2001 From: "semgrep-zcs-prod-semgrep[bot]" <158082902+semgrep-zcs-prod-semgrep[bot]@users.noreply.github.com> Date: Tue, 14 Jul 2026 20:06:29 +0000 Subject: [PATCH 1/2] Pin GitHub Actions to commit SHAs --- .github/workflows/autoapprove.yml | 2 +- .github/workflows/test-pre-commit.yml | 10 +++++----- scripts/bump-version.sh | 0 3 files changed, 6 insertions(+), 6 deletions(-) mode change 100755 => 100644 scripts/bump-version.sh diff --git a/.github/workflows/autoapprove.yml b/.github/workflows/autoapprove.yml index a8b9d2c..97f9a42 100644 --- a/.github/workflows/autoapprove.yml +++ b/.github/workflows/autoapprove.yml @@ -55,7 +55,7 @@ jobs: echo "::add-mask::$TOKEN" echo "token=$TOKEN" >> $GITHUB_OUTPUT - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: ref: develop token: ${{ steps.token.outputs.token }} diff --git a/.github/workflows/test-pre-commit.yml b/.github/workflows/test-pre-commit.yml index a7ba9fa..20cf649 100644 --- a/.github/workflows/test-pre-commit.yml +++ b/.github/workflows/test-pre-commit.yml @@ -2,25 +2,25 @@ jobs: test-hooks: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Configure git safedir properly run: git config --global --add safe.directory "$(pwd)" - name: Fake update file run: git mv tests/python_simple.py python_simple.py - name: Test semgrep pre-commit hook - uses: pre-commit/action@v3.0.0 + uses: pre-commit/action@646c83fcd040023954eafda54b4db0192ce70507 # v3.0.0 with: extra_args: semgrep --hook-stage manual --files python_simple.py - name: Test semgrep-ci pre-commit hook - uses: pre-commit/action@v3.0.0 + uses: pre-commit/action@646c83fcd040023954eafda54b4db0192ce70507 # v3.0.0 with: extra_args: semgrep-ci --hook-stage manual --files python_simple.py - name: Test semgrep-docker-develop pre-commit hook - uses: pre-commit/action@v3.0.0 + uses: pre-commit/action@646c83fcd040023954eafda54b4db0192ce70507 # v3.0.0 with: extra_args: semgrep-docker-develop --hook-stage manual --files python_simple.py - name: Test semgrep-docker pre-commit hook - uses: pre-commit/action@v3.0.0 + uses: pre-commit/action@646c83fcd040023954eafda54b4db0192ce70507 # v3.0.0 with: extra_args: semgrep-docker --hook-stage manual --files python_simple.py diff --git a/scripts/bump-version.sh b/scripts/bump-version.sh old mode 100755 new mode 100644 From cbc8f808915107d9028aae43b7a8e5f7dcae1cb7 Mon Sep 17 00:00:00 2001 From: Leif Date: Tue, 14 Jul 2026 13:08:44 -0700 Subject: [PATCH 2/2] Restore executable bit on scripts/bump-version.sh Co-Authored-By: Claude Opus 4.8 (1M context) --- scripts/bump-version.sh | 0 1 file changed, 0 insertions(+), 0 deletions(-) mode change 100644 => 100755 scripts/bump-version.sh diff --git a/scripts/bump-version.sh b/scripts/bump-version.sh old mode 100644 new mode 100755