This is an automated email from the ASF dual-hosted git repository.
lukaszlenart pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/struts.git
The following commit(s) were added to refs/heads/main by this push:
new 7572dc6bf build(ci): align GitHub Actions with the ASF Actions policy
(#2024)
7572dc6bf is described below
commit 7572dc6bf609f9766424e7c0cb30e04040a9db0f
Author: Lukasz Lenart <[email protected]>
AuthorDate: Fri Oct 16 07:01:00 2026 +0200
build(ci): align GitHub Actions with the ASF Actions policy (#2024)
Group Dependabot security updates per ecosystem and branch, as the policy
recommends, so a burst of advisories opens one PR instead of many.
Move the Scorecards SARIF upload off the deprecated codeql-action v2 pin
onto the v4.38.2 commit already used by codeql.yml.
Co-authored-by: Claude Opus 5.5 <[email protected]>
---
.github/dependabot.yml | 15 +++++++++++++++
.github/workflows/scorecards-analysis.yaml | 2 +-
2 files changed, 16 insertions(+), 1 deletion(-)
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 969bb0a45..5b6731959 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,10 +4,20 @@ updates:
directory: "/"
schedule:
interval: "weekly"
+ groups:
+ security-updates:
+ applies-to: security-updates
+ patterns:
+ - "*"
- package-ecosystem: "maven"
directory: "/"
schedule:
interval: "weekly"
+ groups:
+ security-updates:
+ applies-to: security-updates
+ patterns:
+ - "*"
cooldown:
default-days: 3
target-branch: "main"
@@ -15,6 +25,11 @@ updates:
directory: "/"
schedule:
interval: "weekly"
+ groups:
+ security-updates:
+ applies-to: security-updates
+ patterns:
+ - "*"
cooldown:
default-days: 4
target-branch: "support/struts-6-x-x"
diff --git a/.github/workflows/scorecards-analysis.yaml
b/.github/workflows/scorecards-analysis.yaml
index ee4d1060d..e366b4632 100644
--- a/.github/workflows/scorecards-analysis.yaml
+++ b/.github/workflows/scorecards-analysis.yaml
@@ -65,6 +65,6 @@ jobs:
retention-days: 5
- name: "Upload to code-scanning"
- uses:
github/codeql-action/upload-sarif@f58f0d11ebf5dedd870fab2f999275f7602cfa46 #
2.22.11
+ uses:
github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 #
4.38.2
with:
sarif_file: results.sarif
