From b3c83639c42d97e81bb48f9d9e34f501aab64886 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20ROBERT?= Date: Mon, 9 Nov 2026 09:12:42 +0100 Subject: [PATCH] ci: Plumber v0.7.23, binaire suivi par Dependabot MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit L'action passe à la v0.7.23 (SHA de commit). Le paramètre version est retiré : l'action installe alors le binaire de sa propre release, et Dependabot fait avancer les deux ensemble. Épinglé à part, le binaire restait figé (v0.4.3), parce que Dependabot ne lit pas ce paramètre. --- .github/workflows/plumber.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/plumber.yml b/.github/workflows/plumber.yml index ccd93bc..a85201d 100644 --- a/.github/workflows/plumber.yml +++ b/.github/workflows/plumber.yml @@ -52,9 +52,10 @@ jobs: persist-credentials: false - name: Plumber compliance scan - uses: getplumber/plumber@d3536bae4727b9290d9e69ee25c4350ddbcd91cd # v0.6.0 + # No `version:` input: the action installs the binary of its own release + # (the default in its action.yml), so Dependabot moves both together. + uses: getplumber/plumber@ec8cb3a7edd6a324b33e85109b627b2df6023d94 # v0.7.23 with: - version: "v0.4.3" verify-attestation: "true" # check the binary's SLSA provenance before running # Gate on the Plumber Score itself. `threshold` is DEPRECATED and its # value 100 is explicitly "treated as unset" by the action — it gated