26304981851
95%

Ran 22 May 2026 06:29PM UTC

Jobs 1

Files 54

Run time 1min

Badge

Embed ▾

Committed 22 May 2026 06:26PM UTC coverage: 95.896%. Remained the same

Build # 26304981851

Build Type

push

github

Committed by

web-flow

Commit Message

ci: pin actions to SHAs, restrict default token, enable Dependabot (#136)

CI supply-chain hardening across the two workflows that ship on every
push/PR and on every release.

* SHA-pin every third-party action in `ci.yml` and `release-plz.yml`,
  with a version comment so the human-readable target is still
  greppable. Replaces mutable refs (`@main`, `@stable`, `@v4`, etc.) so
  a future tag/branch reassignment in an upstream action no longer
  changes what runs in this repo.
* Set `permissions: contents: read` at the workflow level in `ci.yml`.
  The default GITHUB_TOKEN had no explicit scope, so test/build jobs
  were inheriting whatever the org/repo defaults were. Closes #129.
* Add `.github/dependabot.yml` for the github-actions ecosystem with
  weekly grouped updates and a conventional-commits prefix, so SHA
  pins don't go stale unnoticed.

`dtolnay/rust-toolchain` is unusual: it picks the toolchain channel
from the ref name, so SHA pinning breaks the implicit `@stable`
signal. Each usage now also passes `toolchain: stable` explicitly to
restore the original behavior.

Companion to #131 (token-scoping); this is the broader supply-chain
hardening the review for that PR called out as a follow-up.

Coverage Stats

7524 of 7846 relevant lines covered (95.9%)

685311.39 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	26304981851.1	22 May 2026 06:29PM UTC	54	95.9	GitHub Action Run

prisma-risk / tsoracle / 26304981851
95%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 26304981851

prisma-risk / tsoracle / 26304981851 95%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 26304981851

prisma-risk / tsoracle / 26304981851
95%

README BADGES
x