Repository navigation
chore(ci): action の SHA 固定・権限の明示・Dependabot 導入 - #12
Merged
Merged
Conversation
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
hatisuka
changed the title
ksugahara0808
approved these changes
Oct 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
変更内容
pr.ymlの Danger の Docker イメージをタグ指定から digest に固定する(ghcr.io/danger/danger-swift-with-swiftlint:3.8.0→@sha256:2ad66810…。現在の 3.8.0 タグと同一イメージ)。actions/checkoutは SHA 固定済みのため変更なしpermissions: contents: readを明示し、Danger の job にだけ必要な権限(PR へのコメント・コミットステータス付与)を明示する.github/dependabot.ymlを追加し、workflow の action(SHA 固定)を毎週月曜 10:00 にまとめて更新する PR が作られるようにする(flugma と同じ設定)背景
org の Actions 既定権限は現在 write。将来 read に切り替える前提で、workflow 先頭を read にし、書き込みが必要な job にだけ権限を明示する。現時点(既定 write)でも動作は変わらない。
SHA 固定するとタグ指定と違い自動で新しい版に追従しなくなるため、Dependabot で更新 PR を受け取る。SDK 本体は外部ライブラリに依存していないため、対象は github-actions のみ。
🤖 Generated with Claude Code