28375061998
84%
master: 93%

Ran 29 Jun 2026 01:22PM UTC

Jobs 1

Files 24

Run time 1min

Badge

Embed ▾

Committed 29 Jun 2026 01:19PM UTC coverage: 84.18%. Remained the same

Build # 28375061998

Build Type

push

github

Committed by

web-flow

Commit Message

ci: pin Actions to SHAs, harden workflow permissions and secrets (#1288)

* ci: pin GitHub Actions to commit SHAs

Switch all workflow `uses:` from mutable tags to full commit SHAs
(with version comments Dependabot keeps current), and drop the zizmor
`unpinned-uses: ref-pin` override so the default hash-pin policy enforces
it. Mitigates the tag-mutation supply-chain class (e.g. tj-actions).

Fix Dependabot auto-merge: the default GITHUB_TOKEN has no `workflows`
scope and refused to enable auto-merge on workflow-touching PRs. Use the
release GitHub App token instead, scoped per step to least privilege.

* ci: pass revalidate secret via env, not inline expansion

Inlining `${{ secrets.REVALIDATE_TOKEN }}` in the run command bakes the
secret into the command string at template-expansion time. Pass it
through the step env instead (zizmor template-injection).

* ci: scope lint.yml write permission to the job

Move the permissions block to the lint job so `statuses: write` no
longer applies workflow-wide; the top level keeps no permissions.

* ci: run Dependabot auto-merge in a dedicated environment

zizmor's secrets-outside-env flags the app private key used in a job
with no environment (CI pins an older zizmor that errors on it). Add an
unprotected `dependabot` environment, matching release.yml.

Coverage Stats

1857 of 2206 relevant lines covered (84.18%)

50.86 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	0 - 28375061998.1	29 Jun 2026 01:22PM UTC	24	84.18	GitHub Action Run

dunglas / mercure / 28375061998
84%
master: 93%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 28375061998

dunglas / mercure / 28375061998 84% master: 93%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 28375061998

dunglas / mercure / 28375061998
84%
master: 93%

README BADGES
x