Pin dependencies #239
Pin dependencies #239
Conversation
To fix code scanning warnings Signed-off-by: Arthit Suriyawongkul <[email protected]>
Signed-off-by: Arthit Suriyawongkul <[email protected]>
Signed-off-by: Arthit Suriyawongkul <[email protected]>
| python -m pip install --upgrade pip | ||
| pip install spdx-tools | ||
| pip install sphinx sphinx_rtd_theme | ||
| pip install pip==25.0 |
There was a problem hiding this comment.
First, thank you for this PR. Good idea!
One question I've asked myself: Will dependabot check for and update these dependency version numbers that are in the GitHub Actions .yml files? I think not, but maybe I'm wrong? I ask this because I worry about remembering to update these version numbers occasionally.
I also wonder if it's possible to configure dependabot to check these .yml files for Python dependency updates? Just some thoughts. I say we merge this PR, but I wanted to raise this point for discussion.
Again, good call on this PR!
There was a problem hiding this comment.
From what I have seen on other repos (spdx-spec and spdx-3-model), dependabot does check Python dependencies in workflow ymls.
There was a problem hiding this comment.
Great. Sounds good!
|
After this got merge, will wait the scorecard/code scanning to update and see if #222 is solved. |
To fix some OpenSSF code scanning warnings
See: https://github.com/spdx/ntia-conformance-checker/security/code-scanning