c-ares / c-ares / 28719733647
90%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 176
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 89.808% (-1.8%) from 91.63%
28719733647

push

github

web-flow 
ci: pin GitHub Actions to SHAs and add Dependabot with auto-merge (#1193)

Pins all third-party GitHub Actions to immutable commit SHAs and sets up
Dependabot to keep them current, with grouped monthly PRs that
auto-merge on green.

## What's here

**1. SHA-pin every action** (`@<sha> # vX.Y.Z`). This converts the
remaining floating tag refs and — more importantly — the two **mutable**
refs (`coverallsapp/github-action@master`,
`awalsh128/cache-apt-pkgs-action@latest`) to immutable digests, closing
the supply-chain gap where a moved tag/branch could inject code into CI.

Two references are intentionally left unpinned:
- `poseidon/wait-for-status-checks` — already SHA-pinned.
- `slsa-framework/slsa-github-generator` — **must** be referenced by a
full `@vX.Y.Z` tag; `slsa-verifier` can't verify a hash-pinned trusted
reusable workflow
([slsa-verifier#12](https://github.com/slsa-framework/slsa-verifier/issues/12)).
Stays at `@v2.0.0`; Dependabot will still bump the tag.

**2. `.github/dependabot.yml`** — one grouped, **monthly** PR for all
`github-actions` updates (the only ecosystem c-ares has to track). Keeps
the SHAs *and* the `# vX.Y.Z` comments current. A **7-day `cooldown`**
(`default-days: 7`) means a release must be public for a week before
it's auto-merged — a supply-chain safety window since these PRs merge
automatically. (github-actions only supports `default-days`, not the
semver-granular cooldown fields.)

**3. `.github/workflows/dependabot-automerge.yml`** — enables
GitHub-native auto-merge on Dependabot PRs so grouped bumps land
automatically once the required **All Checks** status passes. `main`
requires no review, so no approval step is needed; uses only the
built-in `GITHUB_TOKEN` (no external actions to pin).

## Notes
- Auto-merge is already permitted on the repo (`allow_auto_merge` is on)
and squash is enabled, so the workflow uses `--squash`.
- The single required **All Checks** aggregator means an actions-only PR
still runs full CI ... (continued)

24003 of 26727 relevant lines covered (89.81%)

15780.33 hits per line

Coverage Regressions

Lines Coverage ∆ File
5
97.3
 -2.7% test/ares-test.h
1
88.28
 -0.09% src/lib/record/ares_dns_record.c
Jobs
ID Job ID Ran Files Coverage
1 28719733647.1 176
89.81
 GitHub Action Run
Source Files on build 28719733647