mirror of
https://github.com/storytold/deckcraft.git
synced 2026-11-13 09:22:40 -06:00
Dylan M. Taylor
26d0ecba74
Mutable action tags are a supply-chain risk: a moved tag runs different code without a diff. Every workflow action is now pinned through .github/workflows/actions.lock, and CI verifies the lockfile so an out-of-sync or tampered one fails instead of running.
12 lines
725 B
Properties
12 lines
725 B
Properties
sonar.projectKey=storytold_deckcraft
|
|
sonar.organization=storytold
|
|
|
|
# githubactions:S7637 asks for every action to be pinned to a commit SHA. A workflow covered by
|
|
# .github/workflows/actions.lock runs the commit the lockfile records, so its tag refs are pinned
|
|
# and the lockfile covers the actions those actions use too. Sonar does not read lockfiles yet, so
|
|
# the rule flags the tag refs anyway:
|
|
# https://community.sonarsource.com/t/githubactions-s7637-false-positives-for-actions-pinned-through-native-actions-lock/190814
|
|
sonar.issue.ignore.multicriteria=gha-lockfile
|
|
sonar.issue.ignore.multicriteria.gha-lockfile.ruleKey=githubactions:S7637
|
|
sonar.issue.ignore.multicriteria.gha-lockfile.resourceKey=.github/workflows/**
|