From ac5be9cc96896f3b94bf85a9eea1e1d8defc13ec Mon Sep 17 00:00:00 2001 From: Rob Sherman Date: Thu, 30 Jul 2026 11:34:30 -0700 Subject: [PATCH] ci: bump pinned cfdude/.github security workflows to 8931286e Stays SHA-pinned (per the convention documented in this file) -- moves the pin to the hardened workflow rather than switching to a moving @main ref. What the new SHA brings: - timeout-minutes on every job (check-archived 5m, trivy 15m, semgrep 20m). Previously unset, so a wedged step inherited the Actions 6-hour default. This is the CI half of an unbounded-hang class that blocked local commits on 2026-07-30, when a wedged docker credential helper made Trivy block forever refreshing its vulnerability DB. Because these calls are pinned to an immutable SHA they did NOT pick the fix up the way the ~100 @main callers did -- this is the deliberate re-check the comment in this file asks for. Scan behaviour, severity filters, and exit-code semantics are unchanged. --- .github/workflows/security.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 3b0284f..169c612 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -19,14 +19,14 @@ jobs: # Pinned to a commit SHA (not @main) per the org's own pinGitHubActionDigests convention — # a moving branch ref would let a compromised or unexpectedly-changed org workflow silently # run in this repo's CI. Bump deliberately: re-check cfdude/.github before updating the SHA. - uses: cfdude/.github/.github/workflows/security-semgrep.yml@78d5710aa7aa61e40afd490b8192bd44f931759c # main @ 2026-07-20 + uses: cfdude/.github/.github/workflows/security-semgrep.yml@8931286eb4057e4a2829325c1e04e6071ebf3ff4 # main @ 2026-07-30 permissions: contents: read security-events: write trivy: name: Trivy filesystem scan - uses: cfdude/.github/.github/workflows/security-trivy.yml@78d5710aa7aa61e40afd490b8192bd44f931759c # main @ 2026-07-20 + uses: cfdude/.github/.github/workflows/security-trivy.yml@8931286eb4057e4a2829325c1e04e6071ebf3ff4 # main @ 2026-07-30 permissions: contents: read security-events: write