Compliance: unpinned-actions-dependency-audit.yml

Compliance Finding

Category: action-pinning
Severity: error
Check: unpinned-actions-dependency-audit.yml

Detail

Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1

Standard Reference

standards/ci-standards.md#action-pinning-policy

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

This issue was automatically created by the weekly compliance audit.

Weekly Compliance Audit (2026-04-09)

This finding is still open.

Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1

Standard: standards/ci-standards.md#action-pinning-policy

Claude encountered an error —— View job

I'll analyze this and get back to you.

Weekly Compliance Audit (2026-04-10)

This finding is still open.

Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1

Standard: standards/ci-standards.md#action-pinning-policy

@don-petry

Claude finished @don-petry's task in 1m 27s —— View job • claude/issue-103-20260414-1202 • Create PR ➔

Fixing unpinned action in `dependency-audit.yml`

Analyze issue and gather context
Read current dependency-audit.yml workflow
Fetch org standard template for dependency-audit.yml
Look up SHA for the v1 tag of the reusable workflow — commit SHA: ae9709f4466dec60a5733c9e7487f69dcd004e05
Apply fix (pin action to SHA)
Commit and push changes
Create PR — #120
Tag code owner for review

Summary

Pinned petry-projects/.github/.github/workflows/dependency-audit-reusable.yml from @v1 to the underlying commit SHA ae9709f4466dec60a5733c9e7487f69dcd004e05 # v1. No functional change — same workflow version, now compliant with the org action-pinning policy.

ci: pin dependency-audit reusable workflow to SHA

Weekly Compliance Audit (2026-04-17)

This finding is still open.

Detail: Workflow dependency-audit.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1

Standard: standards/ci-standards.md#action-pinning-policy

Claude encountered an error —— View job

I'll analyze this and get back to you.

feat: implement issue #103 — Compliance: unpinned-actions-dependency-…

Resolved! This check is now passing as of 2026-06-05. Closing automatically.

feat: implement issue #103 — Compliance: unpinned-actions-dependency-…

feat: implement issue #407 — Compliance: ruleset-drift-pr-quality-req…

feat: implement issue #103 — Compliance: unpinned-actions-dependency-…

feat: implement issue #409 — Compliance: ruleset-drift-pr-quality-req…

Navigation Menu

Repository navigation

Compliance: unpinned-actions-dependency-audit.yml #103

Compliance Finding

Detail

Standard Reference

Remediation

Fixing unpinned action in `dependency-audit.yml`

Summary

18 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Compliance: unpinned-actions-dependency-audit.yml #103

Description

Compliance Finding

Detail

Standard Reference

Remediation

Activity

don-petry commented on Apr 9, 2026

don-petry commented on Apr 9, 2026

don-petry commented on Apr 10, 2026

don-petry commented on Apr 14, 2026

Fixing unpinned action in dependency-audit.yml

Summary

don-petry commented on Apr 17, 2026

don-petry commented on Apr 18, 2026

18 remaining items

don-petry commented on Jun 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Fixing unpinned action in `dependency-audit.yml`