Skip to content

chore: harden CI workflows and add Dependabot#11

Open
decofe wants to merge 2 commits intomainfrom
georgen/ci-hardening
Open

chore: harden CI workflows and add Dependabot#11
decofe wants to merge 2 commits intomainfrom
georgen/ci-hardening

Conversation

@decofe
Copy link
Copy Markdown
Member

@decofe decofe commented Apr 14, 2026

  • Pin all GitHub Actions to SHAs, bump checkout v3 → v6
  • Add permissions: {} and persist-credentials: false
  • Add Dependabot for cargo and github-actions
  • Bump MSRV 1.80 → 1.85 (serde_spanned@1.1.1 requires edition2024)

Prompted by: georgen

- Bump actions/checkout from v3 to v6 and pin all actions to SHAs
- Add least-privilege permissions
- Add persist-credentials: false to checkouts
- Add Dependabot for cargo and github-actions

Co-Authored-By: grandizzy <38490174+grandizzy@users.noreply.github.com>
serde_spanned 1.1.1 requires edition2024 which needs Rust 1.85+.

Co-Authored-By: grandizzy <38490174+grandizzy@users.noreply.github.com>
@grandizzy grandizzy requested a review from DaniPopes April 14, 2026 07:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants