Compliance: unpinned-actions-dependency-audit.yml

Compliance Finding

Category: action-pinning
Severity: error
Check: unpinned-actions-dependency-audit.yml

Detail

Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1

Standard Reference

standards/ci-standards.md#action-pinning-policy

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

This issue was automatically created by the weekly compliance audit.

Weekly Compliance Audit (2026-04-09)

This finding is still open.

Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1

Standard: standards/ci-standards.md#action-pinning-policy

Claude encountered an error —— View job

I'll analyze this and get back to you.

Weekly Compliance Audit (2026-04-10)

This finding is still open.

Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1

Standard: standards/ci-standards.md#action-pinning-policy

@don-petry

Claude finished @don-petry's task in 1m 44s —— View job • claude/issue-60-20260414-1357 • [Create PR ➔](https://github.com/petry-projects/ContentTwin/compare/main...claude/issue-60-20260414-1357?quick_pull=1&title=Issue%20%2360%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%2360%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

Fixing Unpinned Action in dependency-audit.yml

Gather context and understand the issue
Fetch the standard template for dependency-audit.yml
Look up the SHA for petry-projects/.github at v1 tag → ae9709f4466dec60a5733c9e7487f69dcd004e05
Update workflow file with pinned SHA
Commit and push changes
Create pull request → petry-projects/ContentTwin#74
Self-review PR — single-line diff, correct SHA derivation (annotated tag object → commit), # v1 comment preserved for readability
Tag CODEOWNERS for review — @don-petry notified on the PR

Summary: Changed .github/workflows/dependency-audit.yml line 33 from @v1 to @ae9709f4466dec60a5733c9e7487f69dcd004e05 # v1. The SHA was resolved by dereferencing the annotated v1 tag object (208ec2d...) to its underlying commit (ae9709f...). CI check status can be verified directly on the PR.
| View PR

fix: pin dependency-audit reusable workflow to SHA

Weekly Compliance Audit (2026-04-17)

This finding is still open.

Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1

Standard: standards/ci-standards.md#action-pinning-policy

@don-petry

Claude finished @don-petry's task in 2m 8s —— View job • claude/issue-60-20260418-1840 • [Create PR ➔](https://github.com/petry-projects/ContentTwin/compare/main...claude/issue-60-20260418-1840?quick_pull=1&title=Issue%20%2360%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%2360%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

Fixing Unpinned Action in dependency-audit.yml

Gather context: current file uses @v1; previous PR fix: pin dependency-audit reusable workflow to SHA #74 is open but not merged
Fetch canonical template from petry-projects/.github/standards/workflows/dependency-audit.yml — template also uses @v1, SHA pinning still required
Look up SHA for v1 tag → ee22b427cbce9ecadcf2b436acb57c3adf0cb63d (direct commit)
Update workflow file with pinned SHA
Commit and push changes
Create pull request → petry-projects/ContentTwin#89
Self-review PR — single-line diff, correct SHA (tag dereferenced via API), # v1 comment preserved
Tag CODEOWNERS for review — @don-petry notified on the PR

Summary: Changed .github/workflows/dependency-audit.yml line 33 from @v1 to @ee22b427cbce9ecadcf2b436acb57c3adf0cb63d # v1. The SHA was resolved by looking up the v1 tag directly via the GitHub API (gh api repos/petry-projects/.github/git/refs/tags/v1) — the tag now points directly to a commit (not an annotated tag object). The previous PR #74 from 2026-04-14 has a different SHA (ae9709f...) because v1 was an annotated tag at that time; it has since been updated to point to a new commit.
|

fix(ci): pin dependency-audit reusable workflow to SHA

Resolved! This check is now passing as of 2026-05-26. Closing automatically.

Resolved! This check is now passing as of 2026-06-05. Closing automatically.

Navigation Menu

Repository navigation

Compliance: unpinned-actions-dependency-audit.yml #60

Compliance Finding

Detail

Standard Reference

Remediation

Fixing Unpinned Action in dependency-audit.yml

Fixing Unpinned Action in dependency-audit.yml

28 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Compliance: unpinned-actions-dependency-audit.yml #60

Description

Compliance Finding

Detail

Standard Reference

Remediation

Activity

don-petry commented on Apr 9, 2026

don-petry commented on Apr 9, 2026

don-petry commented on Apr 10, 2026

don-petry commented on Apr 14, 2026

Fixing Unpinned Action in dependency-audit.yml

don-petry commented on Apr 17, 2026

don-petry commented on Apr 18, 2026

Fixing Unpinned Action in dependency-audit.yml

28 remaining items

don-petry commented on May 26, 2026

don-petry commented on Jun 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions