From c09347bb2e8326f7b93f5ef102be8fc5810cd718 Mon Sep 17 00:00:00 2001 From: Evan Date: Mon, 29 Jun 2026 12:00:17 -0700 Subject: [PATCH] chore(ci): pin @action-validator versions in GHA validator workflow Pin @action-validator/core and @action-validator/cli to 0.6.0 instead of installing them unpinned at runtime, resolving the zizmor adhoc-packages finding. Also drops the no-op --save-dev flag (meaningless for a global install). Resolves code-scanning alert #2557 Co-Authored-By: Claude Opus 4.8 --- .github/workflows/github-action-validator.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/github-action-validator.yml b/.github/workflows/github-action-validator.yml index 2673354da55..73b1e6bb3d7 100644 --- a/.github/workflows/github-action-validator.yml +++ b/.github/workflows/github-action-validator.yml @@ -37,7 +37,9 @@ jobs: node-version: "20" - name: Install Dependencies - run: npm install -g @action-validator/core @action-validator/cli --save-dev + # Versions are pinned to avoid ad-hoc, unpinned package installs + # (zizmor adhoc-packages). Bump deliberately when upgrading. + run: npm install -g @action-validator/core@0.6.0 @action-validator/cli@0.6.0 - name: Run Script run: bash .github/workflows/github-action-validator.sh