Skip to content
Closed
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/build.yml
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ jobs:
attestations: write
steps:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
- uses: SonarSource/ci-github-actions/build-poetry@master # dogfood
- uses: SonarSource/ci-github-actions/build-poetry@BUILD-10215-standardize-ghaction-output-logging # dogfood
Copy link

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using a mutable branch ref for an external action makes workflow runs non-reproducible and increases supply-chain risk (the referenced branch can move without any change in this repo). For testing, prefer pinning SonarSource/ci-github-actions to a specific commit SHA (or an immutable tag) and/or ensure this change is reverted before merging into the default branch.

Copilot uses AI. Check for mistakes.
with:
sonar-platform: sqc-eu
deploy-pull-request: true
Expand All @@ -39,6 +39,6 @@ jobs:
id-token: write
contents: write
steps:
- uses: SonarSource/ci-github-actions/promote@master # dogfood
- uses: SonarSource/ci-github-actions/promote@BUILD-10215-standardize-ghaction-output-logging # dogfood
Copy link

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same concern here: referencing SonarSource/ci-github-actions/promote by a branch name is mutable and can change behavior over time without review in this repo. Pin to a commit SHA / immutable tag for the test run, and revert to the standard ref before merging.

Suggested change
- uses: SonarSource/ci-github-actions/promote@BUILD-10215-standardize-ghaction-output-logging # dogfood
- uses: SonarSource/ci-github-actions/promote@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # BUILD-10215-standardize-ghaction-output-logging

Copilot uses AI. Check for mistakes.
with:
promote-pull-request: true