🔧 chore(ci): switch validate-title to zendev v0.0.5#4
Conversation
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 05fc202892
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| - name: Check PR title | ||
| uses: zrr1999/zendev-actions/validate-title@9013ad848b32d287d0258fdbc9f51e350b8eca33 | ||
| uses: zrr1999/zendev/actions/validate-title@v0.0.5 |
There was a problem hiding this comment.
Pin third-party action to immutable commit SHA
This change replaces an immutable SHA-pinned action with a mutable tag (@v0.0.5), which weakens CI supply-chain integrity and reproducibility because the tag can be retargeted without changes in this repository. In .github/workflows/ci-pr-checks.yml, keeping third-party uses: entries pinned to a commit SHA avoids unexpected behavior or malicious code execution if the upstream tag is moved.
Useful? React with 👍 / 👎.
Summary
validate-titleintegration tozendev v0.0.5Validation
origin/mainNotes