chore: update dependencies, pin CI actions, add dependabot#390
Merged
Conversation
- Bump Go module dependencies to latest versions: google.golang.org/grpc v1.67.0 → v1.81.1, go.opentelemetry.io/otel v1.28.0 → v1.44.0, go.opentelemetry.io/otel/sdk v1.28.0 → v1.44.0, golang.org/x/net → v0.55.0, golang.org/x/sys → v0.45.0 - Pin all GitHub Actions to commit SHA in release.yml, project.yml, self-assign.yml, and stale.yaml for supply-chain auditability. - Replace pull_request_target with pull_request in project.yml to avoid running with elevated permissions on fork PRs. - Add dependabot.yml for automated GitHub Actions and Go module dependency updates. - Add security contacts and email to SECURITY.md. - Quote shell variables in devcontainer post-install.sh. Signed-off-by: Ladislav Smola <lsmola@redhat.com> Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Ladislav Smola <lsmola@redhat.com>
Replace individual contact with kagenti-maintainers@googlegroups.com group email for security reporting. Signed-off-by: Ladislav Smola <lsmola@redhat.com> Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Ladislav Smola <lsmola@redhat.com>
pdettori
approved these changes
Jun 1, 2026
pdettori
left a comment
pdettori
left a comment
Member
There was a problem hiding this comment.
All 15 CI checks pass. Changes are clean and well-scoped.
Security improvements confirmed:
pull_request_target→pull_requestinproject.ymlcorrectly removes elevated fork-PR permissions. Note:secrets: inheritwon't pass secrets to fork-triggered runs withpull_request— project-board automation will silently skip external contributors' PRs. This is the correct trade-off vs. the original supply-chain risk.- All GitHub Actions and reusable workflows pinned to commit SHA with version comments.
- Trivy scan passes; Dependency Review passes.
Nit (not blocking): Both commits have a duplicate Signed-off-by trailer — the author's sign-off appears twice, sandwiching the Assisted-By line. Likely from git commit -s followed by git rebase --signoff. DCO passes, but a future git rebase -i cleanup would keep the trailers canonical.
Areas reviewed: CI/GitHub Actions, Go modules, Shell scripts, Security, Documentation, Commits
Commits: 2 commits, both signed off (duplicate trailers, non-blocking)
CI status: All passing ✅
github-project-automation
Bot
moved this from New /:ToDo
to Done
in Rossoctl Issue Prioritization
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
pull_request_targetwithpull_requestin project.ymlDependency updates
Test plan
go build ./...passesAssisted-By: Claude Code