security: pin GitHub Actions to commit SHAs, add Dependabot

Pin all 22 action references across ci.yml, publish.yml, and attest-release.yml to immutable commit SHAs. Mutable tags can be force-pushed by attackers (cf. TeamPCP supply chain campaign). Add Dependabot for github-actions to get weekly PRs when pinned actions have new versions.
2026-06-23 11:41:46 +02:00 · 2026-03-27 21:20:08 +01:00
parent 2813b3dc4c
commit 49d80d3b57
4 changed files with 28 additions and 22 deletions
@@ -21,7 +21,7 @@ jobs:
          GH_TOKEN: ${{ github.token }}

      - name: Attest build provenance
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be  # v2
        with:
          subject-path: |
            cloakbrowser-*.tar.gz